---
title: "List keys"
description: "GET /keys: Returns your partner keys and their status. It never returns a secret."
url: https://docs.tryflume.ai/api/list-keys
updated: 2026-11-11
---

# List keys

> GET /keys: Returns your partner keys and their status. It never returns a secret.

Returns your partner keys and their status. It never returns a secret.

```http
GET https://sandbox-api.tryflume.ai/partner/v1/keys
```

## Request

### Headers

| Header | Required | Description |
|---|---|---|
| `X-Flume-Partner-Key` | Yes | Your partner key. |

### Sample

**curl**

```sh
curl -X GET "https://sandbox-api.tryflume.ai/partner/v1/keys" \
  -H "X-Flume-Partner-Key: $FLUME_PARTNER_KEY"
```

**Python**

```python
import os

import requests

headers = {
    "X-Flume-Partner-Key": os.environ["FLUME_PARTNER_KEY"],
}

response = requests.get(
    "https://sandbox-api.tryflume.ai/partner/v1/keys",
    headers=headers,
    timeout=30,
)
response.raise_for_status()
print(response.json())
```

**Node.js**

```js
const response = await fetch("https://sandbox-api.tryflume.ai/partner/v1/keys", {
  method: "GET",
  headers: {
    "X-Flume-Partner-Key": process.env.FLUME_PARTNER_KEY,
  },
});
if (!response.ok) throw new Error(`${response.status} ${await response.text()}`);
console.log(await response.json());
```

## Returns (200)

Every field is always present. A field with no value is `null`.

| Field | Type | Description |
|---|---|---|
| `keys` | array of objects | Every key, newest first. |
| `keys[].key_id` | string | The key's id. Use it to revoke the key. |
| `keys[].prefix` | string | The start of the key. Safe to log. |
| `keys[].label` | string or null | The name you gave the key. |
| `keys[].status` | enum | `ACTIVE`, `EXPIRING` (replaced, and working until `expires_at`), `REVOKED` or `EXPIRED`. |
| `keys[].created_at` | string | When the key was issued, in UTC. |
| `keys[].last_used_at` | string or null | When the key was last used, in UTC. |
| `keys[].expires_at` | string or null | When a replaced key stops working, in UTC. |

**Response (200)**

```json
{
  "keys": [
    {
      "key_id": "pk_3f9a1c2e5b7d4a6f8e0c1b2d3a4f5e6d",
      "prefix": "sk_dev_acme_Qm4t",
      "label": "rotation 2026-Q4",
      "status": "ACTIVE",
      "created_at": "2026-10-16T08:00:00Z",
      "last_used_at": "2026-10-16T09:14:22Z",
      "expires_at": null
    },
    {
      "key_id": "pk_9e1b4d7a2c5f4068b3a1d9c7e5f2a0b4",
      "prefix": "sk_dev_acme_8f3k",
      "label": null,
      "status": "EXPIRING",
      "created_at": "2026-07-02T10:30:00Z",
      "last_used_at": "2026-10-16T07:58:41Z",
      "expires_at": "2026-10-23T08:00:00Z"
    }
  ]
}
```

## Errors

| Status | Code | Meaning |
|---|---|---|
| 401 | `EMBED_TOKEN_INVALID` | You sent an `Authorization` header and no `X-Flume-Partner-Key`. Flume read the call as one from its own iframe. |
| 401 | `PARTNER_KEY_INVALID` | The partner key is missing, unknown, revoked, expired, or from the other environment. On live, also a platform Flume has not enabled yet. |
| 422 | `VALIDATION_FAILED` | A field is missing, unknown or has an unusable value. `field` names it as a dotted path. Some refusals carry the detail in `details` and leave `field` empty. |
| 500 | `INTERNAL` | Something failed on Flume's side. |

Every code, with its fix: [API error codes](https://docs.tryflume.ai/api/errors.md).

Guide: [Rotate keys](https://docs.tryflume.ai/guides/rotate-keys.md).