curl --request GET \
--url https://api.gigstack.io/v2/users/me/scoped-api-keys/policy \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/scoped-api-keys/policy', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/scoped-api-keys/policy"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": {
"billing_account_id": "<string>",
"eligible_teams": [
{
"id": "<string>",
"name": "<string>"
}
],
"actions": [
{
"id": "<string>",
"label": "<string>",
"group": "<string>"
}
],
"eligible_managers": [
{
"uid": "<string>",
"display_name": "<string>"
}
],
"max_expiry_days": 182,
"max_overlap_seconds": 43200,
"can_create_scoped": true,
"can_emergency_revoke": true,
"is_billing_owner": true
},
"timestamp": 1
}Read eligible exact team/action/manager policy
Integration note: Requires current personal identity and billing-account/per-key ACLs. API keys never manage credentials. Safe metadata only; private browser approval alone reveals a new secret once. Legacy keys remain valid; no forced migration. See API credentials.
Requires an active personal Firebase/MCP identity and current billing-account/per-key management authority. API keys, including legacy keys, cannot manage credentials. Readback contains metadata only, never stored tokens, secret-once browser execution data or reviewer challenges. Follow non-null next_cursor including empty pages. New routes do not inherit key scope permission.
curl --request GET \
--url https://api.gigstack.io/v2/users/me/scoped-api-keys/policy \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/scoped-api-keys/policy', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/scoped-api-keys/policy"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": {
"billing_account_id": "<string>",
"eligible_teams": [
{
"id": "<string>",
"name": "<string>"
}
],
"actions": [
{
"id": "<string>",
"label": "<string>",
"group": "<string>"
}
],
"eligible_managers": [
{
"uid": "<string>",
"display_name": "<string>"
}
],
"max_expiry_days": 182,
"max_overlap_seconds": 43200,
"can_create_scoped": true,
"can_emergency_revoke": true,
"is_billing_owner": true
},
"timestamp": 1
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.
Query Parameters
^[A-Za-z0-9_-]{1,128}$