List API keys
Active keys, oldest first. Keys themselves are never shown again; prefix identifies them.
GET
/v1/project/api-keysRequest
| Method and path | GET/v1/project/api-keys |
|---|---|
| Base URL | https://api.boxline.dev |
| Authentication | Your API key in the x-api-key header (or Authorization: Bearer). The examples read it from BOXLINE_API_KEY. |
Query parameters
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
after | string | – | – | The next value of the previous page (same filters and sort). Opaque; do not build it yourself. |
limit | integer | 100 | – | From 1 to 100. |
curl "https://api.boxline.dev/v1/project/api-keys" \ -H "x-api-key: $BOXLINE_API_KEY"import { Boxline } from "@boxline/sdk";const bx = new Boxline(); // reads BOXLINE_API_KEY and BOXLINE_API_URLfor await (const key of bx.apiKeys.list()) console.log(key.name, key.prefix, key.lastUsedAt);from boxline import Boxlinebx = Boxline() # reads BOXLINE_API_KEY and BOXLINE_API_URLfor key in bx.api_keys.list(): print(key["name"], key["prefix"], key["lastUsedAt"])Responses
200 OK
A page of keys.
Fields
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
data | object[] | – | – | |
data[].id | string | – | – | |
data[].name | string | – | – | |
data[].prefix | string | – | – | |
data[].createdAt | string | – | – | Format: date-time. |
data[].lastUsedAt | string | null | – | – | Format: date-time. |
data[].createdBy | object | null | – | – | Who made it (null for keys made before this was recorded). support is the platform's staff acting as a user, never named. |
data[].createdBy.via | string | – | console, api_key, support | |
data[].createdBy.userId | string | null | – | – | |
data[].createdBy.email | string | null | – | – | |
data[].createdBy.apiKeyId | string | null | – | – | |
next | string | null | – | – | Pass it back as after for the next page; null on the last page. |
{ "data": [ { "id": "key_7Fh2Kx9Lq0Zp4Nm3", "name": "Work account", "prefix": "bxl_ab12", "createdAt": "2026-09-29T10:00:00.000Z", "lastUsedAt": "2026-09-29T10:00:00.000Z", "createdBy": { "via": "console", "userId": "…", "email": "ada@example.com", "apiKeyId": "…" } } ], "next": "eyJvIjoiY3JlYXRlZF9kZXNjIiwidCI6IjIwMjYtMDktMjlUMTA6MDA6MDAuMTIzNDU2WiIsImkiOiI2YzFmIn0"}Errors
Errors have a matching HTTP status and the same body. code is stable, so check it in your code; message is for people. See Errors and request ids.
| Status | Codes | When |
|---|---|---|
| 400 Bad Request | invalid_request, invalid_json, invalid_cursor, invalid_idempotency_key, invalid_extension, variables_with_extensions, terms_not_accepted, invalid_reset_token, invalid_confirmation_code, wrong_password, no_password, invalid_next, invalid_oauth_token | The request is not valid. |
| 401 Unauthorized | unauthorized | Missing or invalid API key. |
{ "error": { "code": "not_found", "message": "session not found", "requestId": "req_4fJx0aQm2Lk9Pz7N" }}Learn more
These docs describe a beta API. Endpoints, fields and SDK methods may change before general availability; breaking changes will be listed in the changelog.