> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # List named and legacy key metadata > [Small working example](/guides/api-credentials) **Integration note:** Requires current personal identity and billing-account/per-key ACLs. API keys never manage credentials. Safe metadata only; private browser approval alone reveals a new secret once. Legacy keys remain valid; no forced migration. See [API credentials](/guides/api-credentials). Requires an active personal Firebase/MCP identity and current billing-account/per-key management authority. API keys, including legacy keys, cannot manage credentials. Readback contains metadata only, never stored tokens, secret-once browser execution data or reviewer challenges. Follow non-null next_cursor including empty pages. New routes do not inherit key scope permission. ## OpenAPI ````yaml openapi.json GET /users/me/scoped-api-keys openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Internal partner provisioning is outside this public contract; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /users/me/scoped-api-keys: get: tags: - Api Keys summary: List named and legacy key metadata description: >- [Small working example](/guides/api-credentials) **Integration note:** Requires current personal identity and billing-account/per-key ACLs. API keys never manage credentials. Safe metadata only; private browser approval alone reveals a new secret once. Legacy keys remain valid; no forced migration. See [API credentials](/guides/api-credentials). Requires an active personal Firebase/MCP identity and current billing-account/per-key management authority. API keys, including legacy keys, cannot manage credentials. Readback contains metadata only, never stored tokens, secret-once browser execution data or reviewer challenges. Follow non-null next_cursor including empty pages. New routes do not inherit key scope permission. operationId: listScopedApiKeys parameters: - name: billing_account_id in: query required: true schema: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ - name: limit in: query required: false schema: oneOf: - type: number - type: string description: Numeric string accepted by the request validator. minimum: 1 maximum: 100 - name: cursor in: query required: false schema: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ responses: '200': description: >- Safe server-authorized lifecycle result; does not reveal a credential. headers: Cache-Control: schema: type: string enum: - no-store content: application/json: schema: type: object additionalProperties: false required: - success - data - timestamp properties: success: type: boolean enum: - true data: $ref: '#/components/schemas/ScopedApiKeyList' timestamp: type: integer minimum: 0 '403': description: >- Personal identity/current management authority required; machine credentials are refused. '404': description: Key is absent or outside current management authority. '409': description: >- State or immutable operation intent changed; read the saved operation/key before further action. security: - bearerAuth: [] components: schemas: ScopedApiKeyList: type: object additionalProperties: false required: - items - next_cursor - capabilities properties: items: type: array items: $ref: '#/components/schemas/ScopedApiKeyMetadata' next_cursor: type: string nullable: true capabilities: $ref: '#/components/schemas/ScopedApiKeyCapabilities' ScopedApiKeyMetadata: type: object additionalProperties: false required: - id - name - scope_version - scope_kind - billing_account_id - team - livemode - team_ids - action_ids - expires_at - manager_user_ids - status - created_at - revoked_at - revoke_at - replacement_key_id - last_used_at - can_manage - can_rotate - can_revoke properties: id: type: string name: type: string nullable: true scope_version: type: integer enum: - 2 nullable: true scope_kind: type: string enum: - scoped - legacy_unrestricted billing_account_id: type: string team: type: string nullable: true livemode: type: boolean nullable: true team_ids: type: array items: type: string action_ids: type: array items: type: string expires_at: type: integer minimum: 0 nullable: true manager_user_ids: type: array items: type: string status: type: string enum: - active - expired - revoked - scheduled_revocation - policy_invalid created_at: type: integer minimum: 0 nullable: true revoked_at: type: integer minimum: 0 nullable: true revoke_at: type: integer minimum: 0 nullable: true replacement_key_id: type: string nullable: true last_used_at: type: integer minimum: 0 nullable: true can_manage: type: boolean can_rotate: type: boolean can_revoke: type: boolean ScopedApiKeyCapabilities: type: object additionalProperties: false required: - can_create_scoped - can_emergency_revoke - is_billing_owner properties: can_create_scoped: type: boolean can_emergency_revoke: type: boolean is_billing_owner: type: boolean securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": … }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.