Endpoint

List API keys

GET/v1/keys

Keys of the calling key's mode. Secrets are never returned after creation.

Scope a restricted key needs: keys:read
Publishable key: Not allowed: secret or restricted key only
Idempotency-Key: Not used. A GET is already safe to repeat.

Parameters

Parameters of List API keys
Parameter	Type and place	Meaning
`type`	stringquery	`secret`, `restricted` or `publishable`.
`status`	stringquery	`active`, `rolling`, `revoked` or `expired`.
`limit`	integerquery	Items per page, 1 to 100. Default 20.
`starting_after`	stringquery	An object id: return the items after it.
`ending_before`	stringquery	An object id: return the items before it.
`created[gte]`	string (date-time)query	Created at or after. Also created[gt], created[lte], created[lt].
`created[lt]`	string (date-time)query	Created before.
`Orrerie-Version`	stringheader	API version date. Default: the version the key was created with. Example `2026-10-11`.

Example request

curl

curl https://api.orrerie.com/v1/keys \
  -H "Authorization: Bearer $ORRERIE_SECRET_KEY"

JavaScript

const response = await fetch("https://api.orrerie.com/v1/keys", {
  headers: {
    Authorization: `Bearer ${process.env.ORRERIE_SECRET_KEY}`,
  },
});
const result = await response.json();
if (!response.ok) throw new Error(`${result.error.code}: ${result.error.message}`);
console.log(result);

Python

import os
import requests

response = requests.get(
    "https://api.orrerie.com/v1/keys",
    headers={"Authorization": f"Bearer {os.environ['ORRERIE_SECRET_KEY']}"},
    timeout=30,
)
result = response.json()
if not response.ok:
    raise RuntimeError(f"{result['error']['code']}: {result['error']['message']}")
print(result)

PHP

<?php
$request = curl_init('https://api.orrerie.com/v1/keys');
curl_setopt_array($request, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('ORRERIE_SECRET_KEY'),
    ],
]);
$body = curl_exec($request);
if ($body === false) {
    throw new RuntimeException(curl_error($request));
}
$result = json_decode($body, true);
if (curl_getinfo($request, CURLINFO_HTTP_CODE) >= 400) {
    throw new RuntimeException($result['error']['code'] . ': ' . $result['error']['message']);
}
print_r($result);

Responses

`200` OK

A list whose data holds api_key objects. Headers: Orrerie-Request-Id.

Example response, 200

{
  "object": "list",
  "url": "/v1/keys",
  "has_more": false,
  "data": [
    {
      "id": "key_6e3gg2c6ea176xxdek2nar6v",
      "object": "api_key",
      "livemode": true,
      "created": "2026-09-03T09:50:00.000Z",
      "name": "Shop backend",
      "type": "restricted",
      "prefix": "sk_live_",
      "last4": "x9Tq",
      "scopes": [
        "checkout_sessions:write",
        "orders:read",
        "refunds:write",
        "events:read"
      ],
      "allowed_ips": [],
      "status": "active",
      "api_version": "2026-10-11",
      "created_by": {
        "type": "member",
        "id": "mem_ceh1wpzdrpk13cnpcjy9w0fa"
      },
      "last_used_at": "2026-10-12T09:30:00.000Z",
      "expires_at": null,
      "rolled_from": null
    }
  ]
}

Any other status: an error

A status of 400 or above answers with the error object. Branch on its code, never on its message.

Errors

This call has no error of its own. It answers with the errors every call can answer with: a bad key, a missing scope, an object that does not exist, the rate limit. Every error code has its own entry.