List API keys | ToAPIs Documentation

GET

/api/v1/account/api-keys

Note for users in mainland China: Please use https://toapis.cn as the API endpoint (Base URL). Replace https://toapis.com with https://toapis.cn in the examples in this document.

See Getting started for authentication, pagination, and errors.

Behavior

Reads metadata for your ordinary model keys only. Lists sort by numeric ID descending and exclude soft-deleted keys and stats:read credentials by default. Details can include your soft-deleted keys. key_hint exposes a fixed mask and the last four characters, or null for short keys. Unlimited quotas use unlimited=true and remaining_credits=null; unrestricted daily/monthly limits are also null. No raw key or webhook secret is returned. Missing and unauthorized keys both return 404.

Authentication

Authorizationstringheaderrequired

Use Bearer YOUR_SYSTEM_ACCESS_TOKEN. Model API keys are not accepted. X-User-Id is not required.

Parameters

limitintegerquerydefault: 50

Maximum number of items per page.

Constraints: minimum=1; maximum=100; Default: 50.

cursorstringquery

Pass the previous next_cursor unchanged and keep the same filters. Restart when filters change.

Constraints: maxLength=2048.

statusstringquery

API key status.

Constraints: enabled, disabled, expired, exhausted, deleted.

requestExample

curl --request GET \
  --url 'https://toapis.com/api/v1/account/api-keys?status=enabled&limit=20' \
  --header 'Authorization: Bearer YOUR_SYSTEM_ACCESS_TOKEN'

import requests

response = requests.get(
    "https://toapis.com/api/v1/account/api-keys",
    headers={"Authorization": "Bearer YOUR_SYSTEM_ACCESS_TOKEN"},
    params={
        "status": "enabled",
        "limit": "20"
    },
    timeout=30,
)
response.raise_for_status()
print(response.json())

const url = new URL("https://toapis.com/api/v1/account/api-keys");
url.search = new URLSearchParams({
  "status": "enabled",
  "limit": "20"
}).toString();

const response = await fetch(url, {
  headers: { Authorization: "Bearer YOUR_SYSTEM_ACCESS_TOKEN" },
  signal: AbortSignal.timeout(30_000),
});

if (!response.ok) {
  throw new Error(`HTTP ${response.status}: ${await response.text()}`);
}
console.log(await response.json());

Response fields

Examples use fictional data and assume credits_per_usd="100". Use the conversion rate returned by the API.

Results are in data.items. Paginate with has_more and next_cursor; the final cursor is null. No total count is returned.

codeinteger

Numeric result code; 0 means success.

messagestring

Response message; empty on success. Error messages are localized.

dataobject

Result object for this query.

data.itemsobject[]

Records on this page; [] when empty.

data.items[].idstring

Model API key ID, not the secret key. Returned as a decimal ID string.

data.items[].namestring

API key name.

data.items[].key_hintstring | null

Fixed mask and last four key characters; never the full secret. Short keys return null.

data.items[].statusstring

Current API key status. Details can include your soft-deleted keys. Values: enabled, disabled, expired, exhausted, deleted, unknown.

data.items[].created_atstring | null

Creation time. RFC 3339 timestamp with a timezone. null when unknown or inapplicable.

data.items[].expires_atstring | null

Key expiration time; null if no expiration is set. RFC 3339 timestamp with a timezone.

data.items[].unlimitedboolean

Whether the key has unlimited quota. If true, remaining_credits=null.

data.items[].remaining_creditsstring | null

Remaining credits. An unlimited API key returns null. Returned as a decimal string to preserve precision.

data.items[].daily_limit_creditsstring | null

Daily quota limit in credits; null when unrestricted. Returned as a decimal string to preserve precision.

data.items[].monthly_limit_creditsstring | null

Monthly quota limit in credits; null when unrestricted. Returned as a decimal string to preserve precision.

data.has_moreboolean

Whether another page is available.

data.next_cursorstring | null

Pass this cursor unchanged with the same filters. It is null on the last page.

data.metaobject

Metadata describing the source, query scope, and accounting basis.

data.meta.scopestring

Ownership scope of the query: the authenticated account itself.

responseExample

{
  "code": 0,
  "message": "",
  "data": {
    "items": [
      {
        "id": "42",
        "name": "Example Key",
        "key_hint": "****abcd",
        "status": "enabled",
        "created_at": "2026-10-01T00:00:00Z",
        "expires_at": null,
        "unlimited": false,
        "remaining_credits": "500",
        "daily_limit_credits": "100",
        "monthly_limit_credits": null
      }
    ],
    "has_more": false,
    "next_cursor": null,
    "meta": {
      "scope": "self"
    }
  }
}