API Keys
Read the API keys on your account and change their status.
Use these endpoints to audit your API keys and to switch them on or off from your own tooling, for example to disable a key the moment it leaks.
GET /v1/account/api_keys
GET /v1/account/api_keys/:api_key_id
POST /v1/account/api_keys/:api_key_idAPI keys are created, disabled and deleted on the
API Keys page. Archiving is the one
change made only through the Admin API. The Admin API never returns the
secret key itself, only a partial_key_hint.
Endpoints
| Method | Endpoint | Description |
|---|---|---|
| GET | /v1/account/api_keys | List API keys |
| GET | /v1/account/api_keys/:api_key_id | Retrieve an API key |
| POST | /v1/account/api_keys/:api_key_id | Update an API key |
Status
| Status | Meaning | Can be set |
|---|---|---|
active | The key works. | Yes |
inactive | The key is switched off. Requests with it are rejected until it is set back to active. | Yes |
archived | The API key is permanently retired. It can never be used or updated again, and it no longer appears in the console; it stays readable through these endpoints for auditing. | Yes, once |
expired | The key's expires_at has passed. | No, it follows expires_at |
Archiving can't be undone. Any update to an archived API key fails with
400 and the message Archived API keys cannot be updated.
The API key object
type'api_key'optionalAlways api_key.
idstringoptionalThe key's ID, starting with key_.
namestringoptionalThe name given to the API key when it was created. Names never change.
partial_key_hintstringoptionalThe start and the last four characters of the key, such as
isk-...x7Qa, so you can recognize it.
created_atstringoptionalWhen the key was created (RFC 3339).
expires_atstring | nulloptionalWhen the key expires (RFC 3339), or null if it never expires.
{
"type": "api_key",
"id": "key_8fQ2LmV9xR4tN7wK1pZ3cB6dHs0J",
"created_at": "2026-09-14T08:21:37.512Z",
"expires_at": null,
"name": "Production backend",
"partial_key_hint": "isk-...x7Qa",
"status": "active"
}