List API Keys

GET /v1/keys/api

List the API keys of your active account. API keys authenticate requests to the management API via the X-API-KEY header — distinct from agent auth tokens, which are presented by tunnel-server agents at handshake.

Account scope & lifecycle: API keys belong to your active account and act as their creator — each inherits the creator's role permissions in that account, resolved live per request. A key created by a member is tied to that member's account membership: when they are removed from (or leave) the account, their keys for it are revoked automatically (requests return 401). An account owner/admin can also revoke any key bound to the account. Use switch account to manage keys in a different account.

The secret is never returned here: the platform stores only a hash of each key, so key is always the mask "****". The full value is shown once, in the create response. If a key has been lost, delete it and create a new one.

Query parameters

page int
Optional. 1-based page number. When sent, the response also carries total, page and page_size; when omitted, every key is returned.
page_size int
Optional. Keys per page when page is sent. Default 15, capped at 200.
q string
Optional. Substring match on description.
status string
Optional. Filter by expiry: never (no expiry), expiring (expires within 7 days), active (expires later than that), expired.

Response (200 OK)

items array
Keys ordered by created_at DESC (newest first). [] when there are none.
total, page, page_size int?
Only when page was sent: the number of matching keys across all pages, the page returned and the effective page size.
items[].uuid string (uuid)
The key's public id. Use in DELETE /v1/keys/api/{uuid}.
items[].user_uuid string (uuid)
The user who created the key.
items[].account_uuid string (uuid)?
The account the key belongs to. Omitted for a legacy key with no account.
items[].key string
Always "****": the key's value is stored only as a hash and can't be shown again. Recreate the key if you've lost it.
items[].description string
Free-form label. Useful for "this key is used by X service".
items[].allowed_ips string?
Comma-separated CIDR allow-list the key may be used from. Omitted when the key has no IP restriction.
items[].expires_at datetime?
When the key stops working. Omitted for a key that never expires.
items[].created_at datetime
RFC 3339 UTC timestamp.
items[].last_used_at datetime?
When the key last authenticated a request. Omitted for a key that was never used.

Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.

Errors

401 Unauthorized
Missing or invalid auth.
Request
curl "https://api.ngris.com/v1/keys/api" \ -H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris client = Ngris(api_key="<your_api_key>") keys = client.api_keys.list_api_keys() for k in keys["items"]: print(f"{k['uuid']} {k['description']} (last used: {k.get('last_used_at', 'never')})")
Response — 200 OK
{ "items": [ { "uuid": "019acd48-a137-7170-bd06-ce3f21e42972", "user_uuid": "019a52c2-ca1e-78ba-ab5c-50362cc29134", "account_uuid": "019a68b9-1a79-7820-a884-41f554aba6bd", "key": "****", "description": "CI/CD pipeline", "allowed_ips": "10.0.0.0/8", "expires_at": "2027-04-29T00:00:00Z", "created_at": "2026-04-29T12:00:00Z", "last_used_at": "2026-04-29T12:34:56Z" } ] }
Was this helpful?
On this page
List API Keys
Was this helpful?
Homepage Docs Dashboard Docs API Docs nvelox Dashboard