Get an API key

GET /v1/api-keys/{key_id} · permission api-keys:read

Returns the metadata of one API key. The raw key is never returned.

last_used_at is written at most once a minute, so it can lag the last request by up to a minute; last_used_ip is the /24 (IPv4) or /48 (IPv6) network of that request, never the full address. The environment receives an api_key.expiry_warned event 30, 7 and 1 days before expires_at (once per threshold; revoked and rotating keys get none).

Request

Parameter	In	Description
`key_id`	path	API key id (`key_…`).

Response

200 OK. The key object.

{
  "id": "key_0000000000000000000000001z",
  "name": "ci",
  "type": "restricted",
  "permissions": ["users:read"],
  "allowed_cidrs": [],
  "last4": "xxxx",
  "created_by": "key_…",
  "created_at": "2026-10-01T10:00:00Z",
  "expires_at": "2027-10-01T10:00:00Z",
  "last_used_at": null,
  "last_used_ip": null,
  "rotated_from": null,
  "revoked_at": null,
  "revoke_reason": null
}

Errors

HTTP	`code`	When
401	`unauthenticated`	The key is missing, invalid or revoked.
403	`insufficient_permissions`	The key lacks the required permission.
404	`not_found`	The key does not exist in this environment.

Example

curl https://api.eu.keenauth.com/v1/api-keys/key_0000000000000000000000001z \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"