---
title: "List API keys"
method: GET
path: "/client/keys"
tags: ["Keys"]
---

# List API keys

`GET /client/keys`

## Request

- Base URL: `https://api.roar-ai.com`
- URL: `https://api.roar-ai.com/client/keys`
- Auth: HTTP bearer

Never returns key plaintext. Requires `keys:read`.

## Response `200`

The account's keys

- ApiKeyList
  - `data` ApiKeyListItem[], required
    - `id` string, uuid, required
    - `name` string, nullable, required
    - `prefix` string, required: The visible head of the key — enough to identify it, never enough to use it
    - `projectId` string, uuid, nullable, required
    - `scopes` string[], required
    - `expiresAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required
    - `spendLimitUsd` string, nullable, required: null = no cap on this key
    - `budgetPeriod` 'day' | 'week' | 'month' | 'total', required
    - `hardCap` boolean, required: A PREFERENCE, and on its own it protects nothing: true = refuse at the cap, false = only alert — but either way it does nothing until `spendLimitUsd` is set. Read `capped` for the question "will this key actually be stopped".
    - `revoked` string, date-time, nullable, required
    - `disabledAt` string, date-time, nullable, required: Paused by its owner — reversible, unlike `revoked`
    - `lastUsedAt` string, date-time, nullable, required
    - `requests` integer, required: Requests in the last 30 days
    - `costUsd` string, required: Spend in the last 30 days
    - `appName` string, nullable, required: The hosted app this key was created for, or null for a key you made yourself. A key with a name here is the credential its app runs on: it cannot be revoked or deleted while the app exists (pause it instead, or delete the app).
    - `appId` string, uuid, nullable, required: The id of that hosted app (as in `/client/apps/{id}`), or null for a key you made yourself. App names are not unique; this is.
    - `capped` boolean, required: Whether spend on this key is actually REFUSED at a limit — `spendLimitUsd` set AND `hardCap` true. Neither field answers that alone, so read this one: a key with `hardCap: true` and no limit is uncapped. The same predicate the gateway itself filters budgets through.
    - `mcp` McpKeyLabel
      - `app` string, required: The assistant app, e.g. Claude
      - `person` string, required: Whose connection it is
      - `personId` string, required: That person’s user id, to tell your own connections from a teammate’s
      - `revokedAutomatically` 'unused' | 'connection_gone' | 'null', nullable, required: Why it was revoked automatically, when it was: unused for 90 days, or the connection is gone. Null when it is live or an admin revoked it.
    - `viaSetup` boolean: True when a coding agent fetched this key with a one-time setup code — requests on it are labelled "AI assistant · API key" in the request log.

## Other responses

- `401`: Unauthenticated
- `403`: Key lacks keys:read

---

[API](https://skmtc.dev/roar-ai/apis/roar-ai-api.md) · [All operations](https://skmtc.dev/roar-ai/apis/roar-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/roar-ai/apis/roar-ai-api/revisions/37e4d0d5a7fe?raw)