---
title: "List API keys"
method: GET
path: "/api/v1/keys"
tags: ["API keys"]
---

# List API keys

`GET /api/v1/keys`

## Request

- Base URL: `https://spoofy.social`
- URL: `https://spoofy.social/api/v1/keys`
- Auth: API key in cookie `better-auth.session_token`

Every key of the signed-in user, revoked ones included. Secrets are never shown again.

## Response `200`

Keys.

- object
  - `keys` ApiKey[]
    - `id` string
    - `name` string
    - `prefix` string: First characters of the key, to tell keys apart.
    - `mode` 'live' | 'test': test: every spend answers as a dry run (the real price, checks and balance; nothing charged or sent); cancelling and pausing are refused.
    - `scopes` string[]
    - `dailyCap` string, nullable: Max USD spent per UTC day (net of refunds); null = no cap.
    - `perOrderCap` string, nullable: Max USD per order; null = no cap.
    - `platforms` string[]: Allowed platforms; empty = all.
    - `allowedIps` string[]: Addresses or CIDR ranges the key works from; empty = anywhere.
    - `lastUsedAt` string, date-time, nullable
    - `lastUsedIp` string, nullable: The address it was last used from.
    - `createdAt` string, date-time
    - `revokedAt` string, date-time, nullable

## Other responses

- `401`: No valid API key or session.
- `403`: Sent with an API key.
- `429`: Slow down: too many requests in a short time. Wait `Retry-After` seconds and carry on.

---

[API](https://skmtc.dev/spoofy/apis/spoofy-api.md) · [All operations](https://skmtc.dev/spoofy/apis/spoofy-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spoofy/apis/spoofy-api/revisions/58adc986f826?raw)