List API keys of a merchant
Requires the api_key.list permission and JWT (dashboard) authentication — API-key authentication is rejected on key-management endpoints.
Returns the active (non-revoked, non-expired) API keys of a merchant that belongs to the authenticated organization, masked (prefix and last 4 characters only).
Authorizations
JWT token for user authentication
Path Parameters
The merchant ID
Response
List of active API keys (masked)
"123e4567-e89b-12d3-a456-426614174000"
"Production backend"
First 7 characters of the key, for masked display
"ak_Ab12"
Last 4 characters of the key, for masked display
"x9Zk"
Last authentication with this key (updated at most every 5 minutes)
"2026-07-20T12:00:00Z"
When the key stops authenticating; null means it never expires
null
When the key was revoked; null means it is active
null
"2026-07-01T00:00:00Z"

