List access keys for the current account

GET

/v1/access-keys

const url = 'https://api.aetherpush.com/v1/access-keys';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.aetherpush.com/v1/access-keys \
  --header 'Authorization: Bearer <token>'

Returns all access keys (sessions and CLI keys) belonging to the current account. The raw key value is always masked as (hidden) in the response — there is no way to recover an existing key. Lost keys must be revoked and recreated.

Authorizations

accessKeyAuth

Responses

200

List of access keys with name masked.

application/json

object

accessKeys

required

Array<object>

object

name

The raw key string. Only returned in full on POST /v1/access-keys (creation). On GET /v1/access-keys it is masked as (hidden). On GET /v1/access-keys/{name} it is omitted entirely.

string

friendlyName

Human-friendly identifier for the key.

string

<= 255 characters

description

Mirrors friendlyName. Kept for legacy clients.

string

createdBy

IP address that created the key.

string

createdTime

Unix timestamp in milliseconds.

integer format: int64

expires

required

Unix timestamp in milliseconds.

integer format: int64

isSession

True if the key was created by a login flow (vs. CLI/manual creation).

boolean

credentialOrigin

How the credential was created. Absent on credentials that predate CLI browser login. cli_browser and cli_device credentials are the ones listed and revoked through /v1/cli/devices.

string

Allowed values: dashboard_session cli_browser cli_device

deviceId

Stable identifier the CLI generates once per machine.

string

deviceName

Human-facing device label shown on the approval screen.

string

clientName

Client that requested the credential.

string

clientVersion

Client version at the time of authorization.

string

clientPlatform

Operating system and architecture reported by the client.

string

Example

{
  "accessKeys": [
    {
      "name": "(hidden)",
      "friendlyName": "my-laptop",
      "description": "my-laptop",
      "createdBy": "203.0.113.42",
      "createdTime": 1714867200000,
      "expires": 1719964800000,
      "isSession": true
    }
  ]
}

401

Unauthenticated.

application/json

Error

Standard error envelope. code is the stable machine identifier for client branching and i18n. The wording of error is a human-readable fallback and is not part of the contract. Specialized responses keep narrower code enums where clients already branch on them.

object

error

required

Human-readable error message.

string

code

required

Stable machine code. Prefer this over matching on error. The values this API can answer with are listed in the ApiErrorCode schema of the raw document at https://api.aetherpush.com/openapi.yaml. The field stays an open string here so that a release adding a value does not invalidate this response.

string

requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string

Example

{
  "error": "The requested resource was not found.",
  "code": "not_found",
  "requestId": "req_abc123"
}

403

API keys and named access keys cannot access this endpoint; a login session is required.

application/json

Error

object

error

required

Human-readable error message.

string

code

required

string

requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string

Example

{
  "error": "This operation requires a login session. API keys and named access keys cannot access it.",
  "code": "session_required",
  "requestId": "req_abc123"
}

429

The tenant’s per-minute management API budget is spent. Retry-After and X-RateLimit-* say when to retry. This is not a plan quota: quota 429s use the Error envelope and do not set Retry-After.

application/json

RateLimitError

Returned with HTTP 429 when an endpoint-specific rate limit is hit, including the per-tenant management API budget. Not the process-wide address limiter (see GlobalAddressRateLimitErrorResponse). retryAfterSeconds indicates how long the client should wait before retrying, and matches the Retry-After header when that header is set. code names the limit that fired so clients can translate without matching on error.

object

error

required

string

code

required

string

retryAfterSeconds

required

integer

>= 1

requestId

string

Example

{
  "error": "Rate limit exceeded",
  "code": "tenant_rate_limit_exceeded",
  "retryAfterSeconds": 60
}

Headers

Retry-After

integer

>= 1

Seconds until the tenant window resets.