---
title: "List API keys"
method: GET
path: "/api/v1/me/api-keys"
tags: ["API Keys"]
---

# List API keys

`GET /api/v1/me/api-keys`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/api/v1/me/api-keys`
- Auth: API key in cookie `auth_token`

List the current user's live API keys (key values are never returned). Each key lists the keys it replaced in `replaced_key_ids`.

## Response `200`

List of API keys

- object
  - `data` UserAPIKeyListItem[], required
    - `id` string, required: MongoDB ObjectId
    - `name` string, required
    - `prefix` string, required: The prefix every key of this environment shares (`pk_live_` or `pk_test_`) — not an identifier of this key.
    - `environment` 'production' | 'test', required
    - `scopes` string[], required
    - `profile_id` string, required: MongoDB ObjectId
    - `last_used_at` string, date-time, nullable: When the key last authenticated a request; absent or null if never
    - `expires_at` string, date-time, nullable, required: When the key stops authenticating; null means it never expires. This list is the only place an owner can still see it once the key has expired.
    - `created_at` string, date-time, required
    - `replaced_key_ids` ObjectId[], required: Ids of the keys this key replaced, newest first: the earlier keys of the same integration, replaced when the key was regenerated (`POST /api/v1/me/api-keys/{id}/regenerate`) or renewed by an MCP sign-in refresh. Requests and usage of those keys count as this key's. Empty when it replaced none. Recorded from the release of key history on; a key replaced before it is not linked.

## Other responses

- `401`: Unauthorized

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/b15f506de696?raw)