List API Keys
GET/api/portal/api-keys
Lists every API key the signed-in buyer holds for the active account: the inventory feed link (is_feed_link: true, always feed:read) and any named, scoped keys. The secret is never included — only last_four to tell keys apart.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
last_used_at is when the key last authenticated a request; last_row_count is the number of rows the last inventory feed pull returned (null for keys never used on the feed).
meta.available_scopes lists the scopes this account may grant: feed:read always, plus dropship:read and dropship:write only when the merchant has turned dropship on for the account. meta.max_keys is the limit on named keys per buyer and account (the feed link does not count toward it).
Request
Responses
- 200
- 401
- 403
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.