# List API keys

Returns the team’s API keys, newest first, each with a masked secret preview and its policy. Page with `cursor`. Set `collection` to `partner` to list the partner keys the team manages instead of its own. Secrets are never included.

## Endpoint

GET `/v1/api-keys`

## Authorization

### Bearer token
`Authorization: Bearer <token>`
with an API key (`sfa_` prefix), an OAuth access token, a session token, or a Space machine credential (`sfm_` prefix).

### OAuth2 access token
OAuth 2.0 with Spacefast scopes. People use the authorization code flow; machines use client credentials.

### Scopes:
`teams:read`

## Query parameters

- `limit` integer required
  - min 1 · max 100 · default: 20
- `cursor` string
  - min length 1 · max length 4096
- `collection` string
  - Allowed: `team`, `partner`
- `teamId` string
  - min length 1

## Responses

### 200 Response for status 200

```json
{
  "$schema": "string<uri>",
  "data": [
    {
      "collection": "string",
      "createdAt": "string<date-time>",
      "createdByUserId": "string",
      "enabled": true,
      "expiresAt": "string<date-time> | any",
      "id": "string",
      "ipAllowlist": ["string"] | any,
      "lastRequestAt": "string<date-time> | any",
      "metadata": {
        "name": "string | any"
      },
      "notBefore": "string<date-time> | any",
      "ownerPrincipal": {
        "type": "string",
        "id": "string"
      },
      "policy": {
        "statements": [
          {
            "actions": ["string"],
            "conditions": {"request.client": "string"},
            "effect": "string",
            "resources": ["string"]
          }
        ],
        "version": "string"
      },
      "preset": "string | any",
      "revokedAt": "string<date-time> | any",
      "secretPreview": "string",
      "subject": {
        "type": "string",
        "id": "string"
      },
      "teamScope": {},
      "updatedAt": "string<date-time>"
    }
  ],
  "pagination": {
    "nextCursor": "string | any",
    "hasMore": true
  }
}
```

### Error Response

```json
{
  "$schema": "string<uri>",
  "type": "string",
  "title": "string",
  "status": integer,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": ["string"],
  "next": ["string"],
  "requestId": "string"
}
```

## Try it
### Server
**Base URL**: https://api.spacefast.com

### Request Example

```bash
curl -X GET "https://api.spacefast.com/v1/api-keys?limit=20" \
  -H "Authorization: Bearer YOUR_TOKEN"
```

```javascript
const response = await fetch("https://api.spacefast.com/v1/api-keys?limit=20", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});
```

```python
import requests

response = requests.get(
    "https://api.spacefast.com/v1/api-keys?limit=20",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)
```