List API keys

GET

/api-keys

const url = 'https://your-org.evershell.ai/v1/api-keys';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://your-org.evershell.ai/v1/api-keys \
  --header 'Authorization: Bearer <token>'

Permissions: apikeys:write.

Returns metadata; secrets are never available after creation.

Authorizations

bearerAuth

Responses

200

application/json

object

api_keys

Array<object>

object

required

string

label

required

string

prefix

required

Obfuscated form of the secret, safe to display

string

permission_set

required

Closed-enum template that determines the perm list WorkOS attaches to the key. See API keys for the per-template scope sets and rationale.

string

Allowed values: full_access submit_observe read_only

created_by_user_id

string

created_at

required

string format: date-time

last_used_at

string format: date-time

Example

{
  "api_keys": [
    {
      "id": "api_key_01HZ",
      "label": "CI runner — staging",
      "prefix": "sk_live_...wxyz",
      "permission_set": "full_access"
    }
  ]
}

401

Missing or invalid credential

application/json

object

error

required

object

code

required

Closed-enum slug (e.g. permission_denied, validation_error, workspace_not_found)

string

message

required

Human-readable summary

string

request_id

required

Server-generated request id for correlating logs

string

details

Optional structured context. Validation errors land at details.fields as a per-field map.

object

key

additional properties

any

Example

{
  "error": {
    "code": "permission_denied",
    "message": "caller lacks required scope",
    "request_id": "7f3a9c2e"
  }
}

403

Caller lacks the required scope, or cross-org access attempted

application/json

object

error

required

object

code

required

Closed-enum slug (e.g. permission_denied, validation_error, workspace_not_found)

string

message

required

Human-readable summary

string

request_id

required

Server-generated request id for correlating logs

string

details

Optional structured context. Validation errors land at details.fields as a per-field map.

object

key

additional properties

any

Example

{
  "error": {
    "code": "permission_denied",
    "message": "caller lacks required scope",
    "request_id": "7f3a9c2e"
  }
}