---
title: "List API keys"
method: GET
path: "/api-keys"
tags: ["Account"]
---

# List API keys

`GET /api-keys`

## Request

- Base URL: `https://api.varg.ai/v2`
- URL: `https://api.varg.ai/v2/api-keys`
- Auth: HTTP bearer

Requires an app session (Supabase JWT), not an API key.

## Query parameters

- `include` 'shared'

## Headers

- `X-Team-Id` string

## Response `200`

API keys

- object
  - `api_keys` ApiKey[]
    - `id` string, uuid, required
    - `key_preview` string, required
    - `name` string, required
    - `type` 'personal' | 'service', required: `personal` acts for the creating user; `service` is a shared credential with no human behind it
    - `on_behalf_of_user_id` string, uuid, nullable, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `last_active_at` string, date-time, nullable, required
    - `revealable` boolean, required: Whether the full key can be shown again (only keys created with `revealable` set to `true`)
    - `role` 'owner' | 'shared', required
    - `owner` object, nullable, required: Whose key this is, when `role` is `shared`
      - `user_id` string
      - `email` string, nullable
      - `display_name` string, nullable
      - `avatar_url` string, nullable
    - `shared_count` integer, required

## Other responses

- `401`: Missing or invalid API key / JWT
- `403`: Only app sessions can manage API keys

## Changes

- **2026-10-20** `43bcf5ea398d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/varg/apis/varg-api/changes/api-keys/get.md)

---

[API](https://skmtc.dev/varg/apis/varg-api.md) · [All operations](https://skmtc.dev/varg/apis/varg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/varg/apis/varg-api/revisions/09d49a6d852f?raw)