---
title: "List the authenticated user's API keys"
method: GET
path: "/v2/account/apikeys"
tags: ["Account"]
---

# List the authenticated user's API keys

`GET /v2/account/apikeys`

Lists every API key on the account, including the ones already expired (kept visible for auditing until the cleanup task removes them).

**The secret is never returned.** It is shown exactly once, when the key is created or when a client authorization is claimed — there is no endpoint that reads a secret back. `prefix` is the first 8 characters of the secret, for matching a key in the panel against a key in a CI log.

`resources` empty means the key reaches the whole account; `expires_at` null means it never expires (manual keys). `last_used_at` is best-effort: it is written outside MongoDB with a 30-day TTL, so a key unused for longer reports null.

Session token only — an API key cannot manage API keys, not even itself.

## Response `200`

API key list. Empty array when the account has no keys.

- object
  - `status` 'success', required
  - `response` object[], required
    - `id` string, required — Identifier used to revoke the key.
    - `name` string, required
    - `prefix` string, required — First 8 characters of the secret.
    - `scopes` string[], required
    - `resources` string[], required — Application/database ids the key is restricted to. Empty = whole account.
    - `client` string, nullable, required — First-party client that requested the key (`vscode`, `cli`), or null when created by hand.
    - `created_at` string, date-time, required
    - `expires_at` string, date-time, nullable, required
    - `last_used_at` string, date-time, nullable, required

## Other responses

- `401` — This endpoint requires a session token (JWT). API keys are not accepted.
- `404` — The authenticated user no longer exists.
- `429` — The authenticated user or API key exceeded the global request budget.
- `500` — An unexpected error occurred while processing the request.

---

[API](https://skmtc.dev/squarecloud/apis/square-cloud-api.md) · [All operations](https://skmtc.dev/squarecloud/apis/square-cloud-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/squarecloud/square-cloud-api/revisions/54b7733a6b95/schema)