# List API keys

`GET /v1/console/keys` (operation id `listKeys`)

Returns every key of the account, including revoked ones. Secrets are never returned after creation.

Authentication: Console session cookie (`__Host-dex_session`). State-changing routes also need the `x-dex-csrf` header.

## Responses

### 200

Keys of the account, newest first.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | string | yes | (always "list") |
| `data` | array of ApiKey | yes |  |
| `data[].id` | KeyId | yes | (pattern ^key_[0-9A-HJKMNP-TV-Z]{26}$) |
| `data[].object` | string | yes | (always "api_key") |
| `data[].name` | string | yes |  |
| `data[].mode` | string | yes | (one of "live", "test") |
| `data[].prefix` | string | yes | The mode prefix plus the first 4 characters, for recognising the key. (pattern ^dex_(live\|test)_[0-9A-Za-z]{4}$) |
| `data[].scopes` | array of Scope | yes | (each item: one of "decide", "usage:read", "balance:read") |
| `data[].limits` | KeyLimits | yes | (no other fields) |
| `data[].limits.requests_per_minute` | integer | no | (1 to 600) |
| `data[].limits.tokens_per_minute` | integer | no | (1,000 to 600,000) |
| `data[].limits.concurrency` | integer | no | (1 to 32) |
| `data[].created_at` | string | yes | (format date-time) |
| `data[].last_used_at` | string \| null | yes | (format date-time) |
| `data[].expires_at` | string \| null | yes | (format date-time) |
| `data[].revoked_at` | string \| null | yes | (format date-time) |

### 401

Missing, unknown, revoked or expired credentials.

### 403

The credentials are valid but not allowed to do this (missing scope, suspended account or failed CSRF check).

### 500

An unexpected error. Any charge was refunded. Retry with the same idempotency key.

### 503

`maintenance`: the console's database, sign-in or payments are unavailable for a moment. Retry after
`retry-after`. Nothing was changed.


## Examples

Illustrative values. Examples show the shape of requests and responses; the numbers in them are not measured results.

Response: One live key and one revoked test key

```json
{
  "object": "list",
  "data": [
    {
      "id": "key_01M54VQCG06CQ643DZVMXXQKFB",
      "object": "api_key",
      "name": "support-router",
      "mode": "live",
      "prefix": "dex_live_Q7mK",
      "scopes": [
        "decide",
        "usage:read",
        "balance:read"
      ],
      "limits": {
        "requests_per_minute": 120,
        "tokens_per_minute": 120000,
        "concurrency": 8
      },
      "created_at": "2026-10-17T08:30:00Z",
      "last_used_at": "2026-10-20T11:59:41Z",
      "expires_at": null,
      "revoked_at": null
    },
    {
      "id": "key_01M4ZQ3B7T2V0N8R6K4Y1C9D5E",
      "object": "api_key",
      "name": "dev-test",
      "mode": "test",
      "prefix": "dex_test_x2Pa",
      "scopes": [
        "decide"
      ],
      "limits": {
        "requests_per_minute": 30,
        "tokens_per_minute": 40000,
        "concurrency": 4
      },
      "created_at": "2026-10-15T09:20:10Z",
      "last_used_at": "2026-10-16T16:02:55Z",
      "expires_at": null,
      "revoked_at": "2026-10-17T08:29:12Z"
    }
  ]
}
```