> ## Documentation Index
> Fetch the complete documentation index at: https://docs.convallax.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List API Keys

> List your active API keys. Secrets are never returned — only a non-secret prefix.

List your active (non-revoked) API keys. For security, the secret is never returned — only a short non-secret `keyPrefix` for identification, plus metadata. Revoked keys are omitted.


## OpenAPI

````yaml api-reference/openapi.json GET /v1/user/api-keys
openapi: 3.1.0
info:
  title: Convallax RFQ API
  version: 3.0.0
  description: >-
    REST surface for the Convallax options protocol — a non-custodial
    request-for-quote marketplace for European calls and puts on Polymarket YES
    outcomes, settled on Polygon.


    **Wire format**: JSON. Successful responses include `"success": true`;
    failures return `{ "success": false, "error": "..." }`.


    **Authentication**: Takers (traders) need no API key — authorization happens
    on-chain at `fill()`. Market makers authenticate with a per-MM API key sent
    as `X-API-Key` (or `?apiKey=`).


    **Streaming**: Quote-request and live-pricing streams use Server-Sent Events
    and the post-trade channel uses WebSocket; those are documented in the
    guides and are not part of this request/response reference.
servers:
  - url: https://api.convallax.com
    description: Production
security: []
tags:
  - name: Series
    description: Browse registered option series available for trading.
  - name: Trading
    description: Open quote requests, read live quotes, and commit to the best price.
  - name: Market Maker
    description: >-
      Submit quotes and confirmation signatures. Authenticated with a per-MM API
      key.
  - name: Settlement
    description: Compute TWAP resolution prices and sign settlement attestations.
  - name: Testnet
    description: Polygon Amoy testnet USDC faucet.
  - name: User
    description: >-
      Account profile and self-serve API keys. Authenticated with a Privy access
      token.
paths:
  /v1/user/api-keys:
    get:
      tags:
        - User
      summary: List API Keys
      description: >-
        List your active (non-revoked) API keys. Secrets are never returned —
        only a short non-secret prefix for identification.
      operationId: listApiKeys
      responses:
        '200':
          description: Active API keys
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyListResponse'
        '401':
          $ref: '#/components/responses/Error'
        '503':
          $ref: '#/components/responses/Error'
      security:
        - PrivyJWT: []
components:
  schemas:
    ApiKeyListResponse:
      type: object
      properties:
        success:
          type: boolean
          const: true
        apiKeys:
          type: array
          items:
            $ref: '#/components/schemas/ApiKeyMeta'
    ApiKeyMeta:
      type: object
      description: API key metadata. Never includes the secret.
      properties:
        id:
          type: string
          format: uuid
          example: 8f3c2b1a-1d2e-4c3b-9a8f-6e5d4c3b2a1f
        name:
          type: string
          example: production-bot
        keyPrefix:
          type: string
          description: Non-secret prefix for identification.
          example: mk_live_9f8e7d6
        createdAt:
          type: string
          format: date-time
          example: '2026-06-16T18:05:00.000Z'
        lastUsedAt:
          type: string
          format: date-time
          nullable: true
          example: null
        revokedAt:
          type: string
          format: date-time
          nullable: true
          example: null
    ErrorResponse:
      type: object
      required:
        - success
        - error
      properties:
        success:
          type: boolean
          const: false
        error:
          type: string
          description: Human-readable error message.
          example: Quote request not found or expired
  responses:
    Error:
      description: Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    PrivyJWT:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Privy access token from the Convallax dashboard, sent as `Authorization:
        Bearer <jwt>`.

````