List API keys

Every key on your team — metadata only, never a token.

GET /v1/api-keys

Requires a Full access API key.

Query parameters

Parameter	Type	Description
limit	number	How many to return. Default 20, min 1, max 100.
after	string	Return keys after this id. Cannot be combined with before.
before	string	Return keys before this id. Cannot be combined with after.

Newest first. Cursor-paginated.

Example

curl

curl "https://api.sendgrail.com/v1/api-keys" \
  -H "Authorization: Bearer $SENDGRAIL_API_KEY"

Node.js

const res = await fetch('https://api.sendgrail.com/v1/api-keys', {
  headers: { Authorization: `Bearer ${process.env.SENDGRAIL_API_KEY}` },
});

const { data } = await res.json();

Response

{
  "object": "list",
  "has_more": false,
  "data": [
    {
      "object": "api_key",
      "id": "91f3200a-df72-4654-b0cd-f202395f5354",
      "name": "Production",
      "permission": "full_access",
      "domain": null,
      "created_at": "2026-04-08T00:11:13+00:00",
      "last_used_at": "2026-11-01T17:09:51+00:00"
    }
  ]
}

No tokens here

A key's token is never in a list, and never in any read — it is stored only as a hash and cannot be recovered. last_used_at is the useful field for housekeeping: a key that has never been used, or not in a long time, is a candidate to delete.