List this newsletter's API keys
Every API key that can reach this newsletter, newest first, revoked ones included. Needs settings: write, not read.
"Can reach" rather than "was issued for": a key can be granted every newsletter its owner runs rather than a named list, and such a key appears here too.
No response from this API ever contains a key's secret. A secret exists in plaintext for one moment, in the reply to the person who minted it in Commune's settings, and Commune keeps only a digest. An entry carries key_prefix instead, the leading fifteen characters, which tells keys apart and cannot be used as one.
self marks the entry this request was made with, which is otherwise impossible to work out: a caller holds a secret and the rows carry ids. It is false on every row when the request was made with an OAuth token, since an OAuth token is not an API key and is not listed here.
Revoked keys stay in the list, so "when was that turned off, and what was it called" stays answerable. Read live to tell the keys that still work from the ones that do not.
There is no filter. A newsletter holds at most twenty live keys, so the collection fits in a page or two.
Request
- Base URL: https://api.usecommune.com
- URL: https://api.usecommune.com/newsletters/{newsletter}/api-keys
- Auth: one of:
- HTTP bearer
- OAuth 2 (authorization code, authorization URL https://usecommune.com/api/oauth/authorize, token URL https://usecommune.com/api/oauth/token, scopes: settings:write)
Query parameters
The pagination.next_cursor value from the previous page. Omit it to read the first page. A cursor is opaque, is only valid for the same operation with the same filters, and is not a durable identifier.
How many items to return in this page. This is a page size, not an offset. Fewer items than requested may come back and that does not mean the collection is exhausted, only an absent next_cursor does.
Comma-separated list of relationship paths to inline in the response. Unexpanded relationships are returned as a reference object carrying only id and object. Each operation documents the paths it accepts, and an unknown path answers 400. Nested paths use a dot, for example article.newsletter.
Comma-separated allow-list of top level properties to return on each object, so a client can trim a response it does not need in full. id and object are always returned. An unknown property name answers 400. Properties omitted by an operation, such as content on any article list, cannot be brought back with fields.
Response
A page of keys, newest first.
Example response
{
"pagination": {
"next_cursor": "Y3Vyc29yOjE3NTY0MjM2MDAwMDA6MDE5MmM4"
},
"data": [
{
"newsletter": {
"object": "newsletter",
"id": "9a4c1c6e-0f2b-4f47-9d3f-6d1b1a2c3d4e"
},
"key_prefix": "cmn_sk_7Qd2xLpA",
"pinned_version": "2026-08-26",
"created_by": {
"object": "newsletter",
"id": "9a4c1c6e-0f2b-4f47-9d3f-6d1b1a2c3d4e"
}
}
]
}Changes
No recorded changes to this operation across all 1 revision of this API.