curl --request GET \
--url https://api.gigstack.io/v2/users/me/scoped-api-keys \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/scoped-api-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/scoped-api-keys"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": {
"items": [
{
"id": "<string>",
"name": "<string>",
"scope_version": 2,
"scope_kind": "scoped",
"billing_account_id": "<string>",
"team": "<string>",
"livemode": true,
"team_ids": [
"<string>"
],
"action_ids": [
"<string>"
],
"expires_at": 1,
"manager_user_ids": [
"<string>"
],
"status": "active",
"created_at": 1,
"revoked_at": 1,
"revoke_at": 1,
"replacement_key_id": "<string>",
"last_used_at": 1,
"can_manage": true,
"can_rotate": true,
"can_revoke": true
}
],
"next_cursor": "<string>",
"capabilities": {
"can_create_scoped": true,
"can_emergency_revoke": true,
"is_billing_owner": true
}
},
"timestamp": 1
}List named and legacy key metadata
Integration note: Requires current personal identity and billing-account/per-key ACLs. API keys never manage credentials. Safe metadata only; private browser approval alone reveals a new secret once. Legacy keys remain valid; no forced migration. See API credentials.
Requires an active personal Firebase/MCP identity and current billing-account/per-key management authority. API keys, including legacy keys, cannot manage credentials. Readback contains metadata only, never stored tokens, secret-once browser execution data or reviewer challenges. Follow non-null next_cursor including empty pages. New routes do not inherit key scope permission.
curl --request GET \
--url https://api.gigstack.io/v2/users/me/scoped-api-keys \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/scoped-api-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/scoped-api-keys"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": {
"items": [
{
"id": "<string>",
"name": "<string>",
"scope_version": 2,
"scope_kind": "scoped",
"billing_account_id": "<string>",
"team": "<string>",
"livemode": true,
"team_ids": [
"<string>"
],
"action_ids": [
"<string>"
],
"expires_at": 1,
"manager_user_ids": [
"<string>"
],
"status": "active",
"created_at": 1,
"revoked_at": 1,
"revoke_at": 1,
"replacement_key_id": "<string>",
"last_used_at": 1,
"can_manage": true,
"can_rotate": true,
"can_revoke": true
}
],
"next_cursor": "<string>",
"capabilities": {
"can_create_scoped": true,
"can_emergency_revoke": true,
"is_billing_owner": true
}
},
"timestamp": 1
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.
Query Parameters
^[A-Za-z0-9_-]{1,128}$1 <= x <= 100^[A-Za-z0-9_-]{1,128}$