REST API: API keys

Use these endpoints to audit which API keys exist for your organization and to revoke ones you no longer trust. List returns every key's metadata, such as its label, scope, and creation time. It does not return the secret key value itself. AgentStack shows a key's secret value only once, at creation time, in the dashboard.

Treat revocation as a security action, not a routine cleanup step. A revoked key stops working immediately for every request already in flight and every request after it. Any service still configured with that key starts failing authorization. Rotate the affected service to a new key before you revoke the old one, so you do not create an outage.

Audit your key inventory on a schedule, not only after an incident. Remove keys tied to a decommissioned integration or a former team member's personal setup. Record why you revoked a key in your own change log, since AgentStack's audit log records the action but not your business reason.

These endpoints require organization-administration access. See MCP scopes for how a connector requests the matching mcp:admin scope, and note that both the REST key and the MCP scope are checked independently of each other — holding one does not substitute for the other.