# List API Keys

> The workspace's live API keys: name, prefix and scopes.

Requires an API key with the `admin` scope.

N e Not available while acting as a client workspace. API keys are never created, listed or revoked over MCP.

## Query Parameters

<ParamField query="page" type="integer">
  Page number, starting at 1.
</ParamField>

<ParamField query="pageSize" type="integer">
  Results per page, 1 to 100. Default 50.
</ParamField>

## Response

Returns a paginated list in `data`. A key's secret and hash are never returned; use the prefix to recognise a key.

<RequestExample>
```bash cURL
curl -X GET "https://api.foxreach.io/api/v1/api-keys" \
  -H "X-API-Key: otr_your_key"
```

```python Python SDK
from foxreach import FoxReach

client = FoxReach(api_key="otr_your_key")
keys = client.api_keys.list()
```

```typescript TypeScript SDK
import { FoxReach } from "foxreach";

const client = new FoxReach({ apiKey: "otr_your_key" });
const keys = await client.apiKeys.list();
```

</RequestExample>

<ResponseExample>
```json
{ "data": [{ "id": "cak_abc123", "name": "CI deploy", "prefix": "otr_ab12", "scopes": ["read", "write"], "lastUsedAt": null, "expiresAt": null, "createdAt": "2026-11-04T09:30:00+00:00" }], "meta": { "page": 1, "pageSize": 50, "total": 1, "totalPages": 1 } }
```
</ResponseExample>

## Errors

| Status | Description |
|--------|-------------|
| `401` | Missing, invalid, revoked or expired API key |
| `403` | The key lacks the `admin` or `write` scope, or its creator lacks the required role |
| `403` | Called while acting as a client workspace with `X-Workspace-Id` (`acting_as_forbidden`) |

## Rate Limit

- **300 requests per minute, shared by every `read` call in your workspace.** Fixed 60-second window.
- Every response includes `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` (unix epoch seconds) and `X-RateLimit-Bucket` (`read`).
- A `429` response includes a `Retry-After` header (seconds until the bucket resets).

For client-side patterns, see [Rate Limiting](/rate-limiting).