Skip to main content
Retrieve a paginated list of API keys for dashboard and administrative interfaces. Use this to build key management dashboards, filter keys by user with externalId, or retrieve key details for administrative purposes. Each key includes status, metadata, permissions, and usage limits. Important: Set decrypt: true only in secure contexts to retrieve plaintext key values from recoverable keys. Required permissions:
  • api.*.read_key or api.<api_id>.read_key (to read keys)
  • api.*.read_api or api.<api_id>.read_api (to read the API)
  • api.*.decrypt_key or api.<api_id>.decrypt_key (additionally required when using --decrypt)
See the API reference for the full HTTP endpoint documentation.

​
Usage

unkey api apis list-keys [flags]

​
Flags

​
--api-id
string
required
The API namespace whose keys you want to list. Returns all keys in this API, subject to pagination and filters.
​
--limit
integer
default:100
Maximum number of keys to return per request. Balance between response size and number of pagination calls needed. Must be between 1 and 100.
​
--cursor
string
Pagination cursor from a previous response to fetch the next page. Use when hasMore: true in the previous response.
​
--external-id
string
Filter keys by external ID to find keys for a specific user or entity. Must exactly match the externalId set during key creation.
​
--decrypt
boolean
default:false
When true, includes the plaintext key value in the response. Only works for keys created with recoverable: true. Requires the decrypt_key permission on the calling root key. Never enable this in user-facing applications.
​
--revalidate-keys-cache
boolean
default:false
Experimental. Skip the cache and fetch keys directly from the database. Use this when you have just created a key and need to see it immediately, or when debugging cache consistency issues. This comes with a performance cost and should be used sparingly.

​
Global Flags

FlagTypeDescription
--root-keystringOverride root key ($UNKEY_ROOT_KEY)
--api-urlstringOverride API base URL (default: https://api.unkey.com)
--configstringPath to config file (default: ~/.unkey/config.toml)
--outputstringOutput format — use json for raw JSON

​
Examples

unkey api apis list-keys --api-id=api_1234abcd

​
Output

Default output shows the request ID with latency, followed by the list of keys: 
req_1234abcd (took 82ms)

[
  {
    "keyId": "key_1234abcd",
    "start": "sk_prod",
    "enabled": true,
    "name": "Production API Key",
    "createdAt": 1704067200000
  },
  {
    "keyId": "key_5678efgh",
    "start": "sk_dev",
    "enabled": true,
    "name": "Development Key",
    "createdAt": 1704153600000
  }
]
With --output=json, the full response envelope including pagination is returned: 
{
  "meta": {
    "requestId": "req_1234abcd"
  },
  "data": [
    {
      "keyId": "key_1234abcd",
      "start": "sk_prod",
      "enabled": true,
      "name": "Production API Key",
      "createdAt": 1704067200000
    }
  ],
  "pagination": {
    "cursor": "key_1234abcd",
    "hasMore": true
  }
}
Last modified on March 26, 2026