> ## Documentation Index
> Fetch the complete documentation index at: https://docs.signa.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Get API Key

> Retrieve a single API key by ID

## Overview

Returns the metadata for a single API key. The raw key secret is never returned; only the `prefix` (the first 12 characters of the key) is included, for identification. The full secret is shown once, when the key is created or rotated.

Revoked and expired keys are still retrievable here so audit history stays intact; check the `status` field.

Requires the `api-keys:manage` scope.

## Path Parameters

<ParamField path="id" type="string" required>
  API key ID (`key_...`).
</ParamField>

## Response

<ResponseField name="id" type="string">API key ID.</ResponseField>
<ResponseField name="object" type="string">Always `api_key`.</ResponseField>
<ResponseField name="name" type="string">Human-readable name.</ResponseField>
<ResponseField name="prefix" type="string">First 12 characters of the raw key, for identification. The full secret is never returned.</ResponseField>
<ResponseField name="scopes" type="string[]">Scopes granted to this key.</ResponseField>
<ResponseField name="rate_limit_tier" type="string">Rate limit tier label for the key.</ResponseField>
<ResponseField name="status" type="string">Lifecycle state: `active`, `expired`, or `revoked`.</ResponseField>
<ResponseField name="expires_at" type="string | null">Expiry timestamp, or `null` for a non-expiring key.</ResponseField>
<ResponseField name="last_used_at" type="string | null">Timestamp of the last API call with this key, or `null` if never used.</ResponseField>
<ResponseField name="metadata" type="object">Key-value metadata.</ResponseField>
<ResponseField name="revoked_at" type="string | null">Revocation timestamp, or `null`.</ResponseField>
<ResponseField name="created_by" type="string">ID of the API key that created this key.</ResponseField>
<ResponseField name="created_at" type="string">Creation timestamp.</ResponseField>
<ResponseField name="updated_at" type="string">Last update timestamp.</ResponseField>
<ResponseField name="request_id" type="string">Unique request identifier for support and debugging.</ResponseField>

<ResponseExample>
  ```json theme={null}
  {
    "id": "key_Mc2eF6gH",
    "object": "api_key",
    "name": "Aurora Digital production",
    "prefix": "sig_7kMn2pQr",
    "scopes": ["trademarks:read", "billing:read"],
    "rate_limit_tier": "standard",
    "status": "active",
    "expires_at": null,
    "last_used_at": "2026-06-11T14:30:00.000Z",
    "metadata": { "environment": "production" },
    "revoked_at": null,
    "created_by": "key_Lb1dE5fG",
    "created_at": "2026-01-05T12:00:00.000Z",
    "updated_at": "2026-06-11T14:30:00.000Z",
    "request_id": "req_uN0eF6gH"
  }
  ```
</ResponseExample>

## Code Examples

<CodeGroup>
  ```bash cURL theme={null}
  curl "https://api.signa.so/v1/organization/api-keys/key_Mc2eF6gH" \
    -H "Authorization: Bearer sig_YOUR_KEY"
  ```

  ```typescript TypeScript theme={null}
  import { Signa } from "@signa-so/sdk";

  const signa = new Signa({ api_key: process.env.SIGNA_API_KEY });

  const apiKey = await signa.organization.apiKeys.retrieve("key_Mc2eF6gH");
  ```
</CodeGroup>

## Errors

| Status | Type               | Description                                      |
| ------ | ------------------ | ------------------------------------------------ |
| 400    | `validation_error` | Invalid API key ID                               |
| 401    | `unauthorized`     | Missing or invalid API key                       |
| 403    | `forbidden`        | API key lacks `api-keys:manage`                  |
| 404    | `not_found`        | API key does not exist or belongs to another org |

## Related Endpoints

* [List API Keys](/api-reference/administration/list-api-keys)
* [Update API Key](/api-reference/administration/update-api-key)
* [Rotate API Key](/api-reference/administration/rotate-api-key)