---
title: "Reveal an API key"
method: POST
path: "/api-keys/{id}/reveal"
tags: ["Account"]
---

# Reveal an API key

`POST /api-keys/{id}/reveal`

## Request

- Base URL: `https://api.varg.ai/v2`
- URL: `https://api.varg.ai/v2/api-keys/{id}/reveal`
- Auth: HTTP bearer

Returns the full key again. Works only for keys created with
`revealable: true`; other keys are shown once, at creation. Allowed for
the key's owner (or a manager of the owning team) and for people the
key is shared with. The response is never cacheable.
Requires an app session (Supabase JWT), not an API key.

## Path parameters

- `id` string, uuid, required

## Response `200`

The plaintext key

- object
  - `api_key` string, required

## Other responses

- `401`: Missing or invalid API key / JWT
- `403`: Only app sessions can manage API keys (API keys and connected applications are rejected)
- `404`: Unknown API key, or you have no access to it
- `409`: The key was not created revealable

## Changes

- **2026-10-20** `43bcf5ea398d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/varg/apis/varg-api/changes/api-keys/:id/reveal/post.md)

---

[API](https://skmtc.dev/varg/apis/varg-api.md) · [All operations](https://skmtc.dev/varg/apis/varg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/varg/apis/varg-api/revisions/09d49a6d852f?raw)