List the tenant's API keys
const url = 'https://api.pixonaut.app/v1/api-keys';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://api.pixonaut.app/v1/api-keys \ --header 'Authorization: Bearer <token>'Operation ID: apiKeys.list
Newest first. Metadata only: a key itself is shown once, when it is created. Each key names the member who created it (createdBy, with their name as it is now), or null when no member did: a key a secret key created, or one the deployment configures.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”The keys
object
The connected store the key was given to; null for a key minted on its own. Such a key is revoked by disconnecting the store.
The member who created the key; null for one a secret key created.
object
When an MCP key stops working; null for a key that never does.
A key from the deployment’s configuration: listed, never revocable here.
The feature the key works only while the tenant has: api for a secret key and a publishable key for origins beyond the tenant’s own site, mcp for an MCP key; null for a connected store’s integration key and a publishable key bound to the tenant’s own site.
Examples
Example
[ { "allowedOrigins": [ "https://shop.acme.example" ], "connectionId": null, "createdAt": 1757408000000, "createdBy": { "name": "Alexandra Lind", "userId": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d" }, "expiresAt": null, "id": "3b2d9c1e-5a4f-4e7d-8c6b-1a0f9e8d7c6b", "kind": "pk", "label": "Storefront widget", "managed": false, "needsFeature": "api" }, { "allowedOrigins": [], "connectionId": null, "createdAt": 1752224000000, "createdBy": { "name": "Alexandra Lind", "userId": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d" }, "expiresAt": null, "id": "d4c3b2a1-0f9e-4d8c-9b7a-6e5f4d3c2b1a", "kind": "sk", "label": "Order backend", "managed": false, "needsFeature": "api" }]Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: unauthorized
object
Examples
unauthorized
{ "error": "unauthorized"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: origin_forbidden, feature_disabled
object
The feature the tenant does not have. Always sent with feature_disabled.
Examples
feature_disabled
{ "error": "feature_disabled", "feature": "api"}origin_forbidden
{ "error": "origin_forbidden"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: db_error. A request that failed unexpectedly answers as text instead.
object
Examples
db_error
{ "error": "db_error"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Questions? Write to [email protected].