Get API Key
Returns the full metadata record for one of the caller's keys — name, scopes, rate limit, expiry, revocation state, and last-used timestamp. **The secret is not returned**, and cannot be: only an HMAC-SHA256 hash of it is stored. If you have lost a key's value, rotate it. `keyPrefix` and `keySuffix` are the only fragments kept, and neither is enough to reconstruct the key. Session-authenticated only — an API key cannot be used to manage API keys.
Internal session cookie for local development.
In: cookie
Path Parameters
The ID of the API key to fetch.
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/api/v1/api-keys/string"{ "success": true, "message": "API key fetched successfully", "data": { "id": "cmnu7bxq2000163lk4d1zqp8n", "keyPrefix": "vw_a1b2c", "keySuffix": "9f8e7d6", "name": "CI pipeline", "userId": "cmnu7awv4000063lk18zpon2m", "isActive": true, "rateLimit": 20, "scopes": [ "user:read", "resume:read" ], "expiresAt": "2027-04-11T10:37:35.584Z", "revokedAt": null, "createdAt": "2026-04-11T10:37:35.584Z", "updatedAt": "2026-04-11T10:37:35.584Z", "lastUsed": "2026-07-29T09:55:00.000Z" }}List API KeysGET
Lists the caller's API keys, newest first. **No form of the secret is returned here — not even a masked one.** Each entry carries only `keyPrefix`, the first 8 characters of the key, which is enough to tell keys apart in a list. If you lose a secret, rotate the key. Session-authenticated only — an API key cannot be used to manage API keys.
Create API KeyPOST
Generates a new API key. **The full secret is returned exactly once, in this response.** It is stored only as an HMAC-SHA256 hash and can never be retrieved again — save it immediately. Session-authenticated only — an API key cannot be used to mint API keys.