---
title: "List your API keys"
method: GET
path: "/management-console/account/api-keys.json"
tags: ["Your account"]
---

# List your API keys

`GET /management-console/account/api-keys.json`

## Request

- Base URL: `https://verifiedhandles.org`
- URL: `https://verifiedhandles.org/management-console/account/api-keys.json`
- Auth: HTTP bearer

Every key your account has made, live or not, newest first; `this_key` marks the one making the request. Never a secret. Any account may list its own, even one that may no longer make keys. `apps` are the apps connected to the account through OAuth: the live ones, then the 20 that ended most recently.

## Response `200`

Your keys and connected apps.

- object
  - `sub` string, required
  - `keys` ApiKeyRow[], required
    - `id` string, required
    - `name` string, required
    - `prefix` string, required: The key’s public part, `vhk_<prefix>_…`; the secret is never shown again.
    - `state` 'live' | 'revoked' | 'expired', required
    - `role_ceiling` 'registered' | 'trusted_editor' | 'admin', required: The key never acts above this role.
    - `read_only` boolean, required
    - `created_at` string, date-time, required
    - `expires_at` string, date-time, nullable, required
    - `last_used_at` string, date-time, nullable, required
    - `revoked_at` string, date-time, nullable, required
    - `this_key` boolean, required: It is the key making this request.
  - `apps` ConnectedAppRow[], required
    - `key` string, required: The connection’s key id: disconnect it with `POST …/account/api-keys/<key>/revoke`.
    - `client_name` string, required: The name the app gave itself.
    - `client_host` string, required: Where the app’s details are published (its `client_id`’s host); for an app that registered itself, where it returns the person to (its redirect’s host, or its private-use scheme).
    - `unverified` boolean, required: The app registered itself, so the site cannot confirm who made it.
    - `state` 'live' | 'revoked' | 'expired', required
    - `role_ceiling` 'registered' | 'trusted_editor' | 'admin', required: The app never acts above this role.
    - `read_only` boolean, required
    - `created_at` string, date-time, required
    - `expires_at` string, date-time, required
    - `last_used_at` string, date-time, nullable, required
    - `revoked_at` string, date-time, nullable, required

## Other responses

- `302`: No key was sent: the console sends a browser to sign in. A script should send its key.
- `400`: The request sent a key and a session cookie together (`bearer_with_cookie`): send one.
- `401`: The key was refused: unknown, revoked or expired, its holder may no longer use keys, or this instance takes none. Carries `WWW-Authenticate: Bearer`.
- `403`: The key’s account lacks the capability, or is blocked: the body is the word `Forbidden`.
- `503`: The site is down for maintenance. The body is the maintenance page, as HTML. Try again later: `Retry-After` gives the seconds.

---

[API](https://skmtc.dev/verifiedhandles/apis/verified-handles-api.md) · [All operations](https://skmtc.dev/verifiedhandles/apis/verified-handles-api/llms.txt) · [OpenAPI document](https://skmtc.dev/verifiedhandles/apis/verified-handles-api/revisions/40720de2e0ec?raw)