List this workspace's keys
Needs an admin key (fx_admin_…), made by the workspace owner in the console — or a signed-in owner or admin. Ordinary API keys are refused with ADMIN_KEY_REQUIRED.
Newest first, revoked keys included — a revocation is history worth seeing.
Authorization
adminKey Authorization: Bearer fx_admin_<id>_<secret>.
An admin key manages this workspace's ordinary API keys (/v1/api-keys) and can do nothing else.
Only the workspace owner makes one, in the console, optionally limited to IP addresses and given
an expiry. Every request made with one is audited.
In: header
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/v1/api-keys"{ "data": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "publicId": "string", "hint": "string", "environment": "live", "scopes": [ "string" ], "lastUsedAt": null, "expiresAt": null, "revokedAt": null, "createdAt": "2019-08-24T14:15:22Z", "limits": null, "createdBy": null, "createdByAdminKey": null } ]}Create a key POST
**Needs an admin key** (`fx_admin_…`), made by the workspace owner in the console — or a signed-in owner or admin. Ordinary API keys are refused with `ADMIN_KEY_REQUIRED`. Returns the key in `key`, **once**. We cannot show a key again after creation, or recover it. A lost key is replaced, not recovered. `admin`, `keys:manage`, `members:manage` and `billing:manage` cannot be granted here, not even by an admin key. Issue narrow keys: an integration that only reads positions should hold `trading:read` and nothing else. A console session confirms it's you first (`403 STEP_UP_REQUIRED`) only when the key can move money or accounts — `trading:execute`, `trading:reduce` or `accounts:write`. A read-only key, or one that only manages webhooks, is created without one.
Read one key GET
**Needs an admin key** (`fx_admin_…`), made by the workspace owner in the console — or a signed-in owner or admin. Ordinary API keys are refused with `ADMIN_KEY_REQUIRED`. A key's name, scopes, environment label, hint and when it was last used — never the key itself, which is shown only once, when it is created.