List API keys
Keys belong to the organisation, not to the human who created them — revoking a member never breaks production. Secrets are hashed at rest and never returned here: only the readable prefix is.
Minimum role: admin.
Authorizations
Short-lived JWT issued by the CarHub auth service (Better Auth), verified against its
JWKS. Claims: sub (user), org_id (active organisation) and role
(owner | admin | member). Used by the dashboard for /mgmt/v1/… only — it is never
accepted on /v1/….
Query Parameters
Page size.
1 <= x <= 100Opaque cursor from the next_cursor of the previous page. Do not construct or parse it.
255Keep only live (true) or test (false) records. Omitted, both are returned.
Include revoked keys in the listing.
Response
A page of API keys.
Cursor pagination, used by every list in this API. Ask for the next page by passing
next_cursor back as cursor; stop when has_more is false. Cursors are opaque and
stable across inserts — never build one yourself.