API reference › API keys › List keys

List API keys

Every key on the tenant, oldest first, revoked ones included.

curl -s https://api.propgate.dev/v1/api-keys \
  -H "authorization: Bearer pg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

{
  "data": [
    {
      "createdAt": "2026-08-01T09:12:44.000Z",
      "createdBy": "you@example.com",
      "id": "019fcb02-...",
      "lastUsedAt": "2026-08-04T11:02:00.000Z",
      "name": "onboarding",
      "object": "api_key",
      "prefix": "pg_live_7c1d",
      "revoked": true,
      "revokedAt": "2026-08-05T14:03:00.000Z"
    },
    {
      "createdAt": "2026-08-05T14:02:11.000Z",
      "createdBy": "you@example.com",
      "id": "019fcf6b-...",
      "lastUsedAt": "2026-08-05T15:40:02.000Z",
      "name": "staging",
      "object": "api_key",
      "prefix": "pg_live_9f2a",
      "revoked": false,
      "revokedAt": null
    }
  ],
  "error": null,
  "meta": null
}

No entry here ever carries a secret. Only prefix — the four characters after pg_live_ — appears; the full key exists nowhere but the hash in storage and the one response that returned it. Revoked keys stay in the list rather than disappearing, because "was this key ever valid" and "who made it" are questions an audit asks about a key long after it stops working.

createdBy is the address of whoever authenticated the request that created the key, or null when nobody is on record — an operator-minted key, or one that predates this column. It is the address rather than a member id: there is no way to look up a single member by id, only the whole list, so an address is the one identifier that resolves to something on its own.