---
title: "The signed-in site user's keys (session cookie, not a key)"
method: GET
path: "/keys"
tags: ["keys"]
---

# The signed-in site user's keys (session cookie, not a key)

`GET /keys`

## Request

- Base URL: `https://api.tradingpal.io/api/v1`
- URL: `https://api.tradingpal.io/api/v1/keys`
- Auth: API key in cookie `tp_sessionid`

Lists the signed-in site user's active keys, newest first, without their secrets. This route is authenticated by the site's session cookie, not by an API key; it serves the developers page. Revoked keys are not listed.

## Response `200`

OK

- Keys: The signed-in site user's active keys.
  - `keys` Key[]: The user's active (unrevoked) keys, newest first, without secrets.
    - `id` integer: Numeric id of the key; the key_id of DELETE /keys/{key_id}.
    - `prefix` string: The first 16 characters of the key (tp_live_ plus eight), enough to tell keys apart. The rest is never shown again.
    - `name` string: The label given at creation (default "default"), at most 64 characters.
    - `created_at` string, date-time: When the key was created, ISO 8601 date-time.
    - `last_used_at` string, date-time, nullable: When the key last authenticated a request, refreshed at most every five minutes. Null until first use.
    - `key` string: The full secret key, present only in the POST /keys response. Store it: only its hash is kept, so it cannot be shown again.

## Other responses

- `403`: not signed in to the site

---

[API](https://skmtc.dev/tradingpal/apis/tradingpal-pattern-api.md) · [All operations](https://skmtc.dev/tradingpal/apis/tradingpal-pattern-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tradingpal/apis/tradingpal-pattern-api/revisions/e96e1f20c1ce?raw)