Skip to content
StraventaDocs
Now in Sandbox.

List API keys

GET
/v1/ocr/api-keys

Returns metadata for every API key in the caller's own environment. The plaintext is never returned here — it is shown exactly once, at creation. This endpoint exists because revocation is not operable without it: an operator cannot revoke an id they have no way to discover.

Authorization

MerchantApiKey
AuthorizationBearer <token>

Merchant API key, presented as Authorization: Bearer ok_live_… (or ok_test_… in sandbox). The key is stored as a SHA-256 hash; only a 16-character lookup prefix is retained in clear for display. A revoked key, an unknown key, and a malformed or absent header all return the same 401 so the response cannot be used to enumerate valid prefixes.

In: header

Response Body

application/json

application/json

application/json

application/json

curl -X GET "https://sandbox.505pay.link/v1/ocr/api-keys"
{
  "total": 1,
  "api_keys": [
    {
      "id": "0198f3c4-2b7a-7c1e-9f10-3a5b6c7d8e9f",
      "key_prefix": "ok_live_9f3a1c07",
      "env": "live",
      "scope": "data",
      "name": "invoice pipeline",
      "created_at": "2026-08-15T04:21:07Z"
    }
  ]
}
{
  "error": "invalid_api_key",
  "message": "API key is invalid or has been revoked",
  "request_id": "01J2ZK8Q7X9V4R6M3N1P5T7W2C"
}
{
  "error": "invalid_api_key",
  "message": "API key is invalid or has been revoked",
  "request_id": "01J2ZK8Q7X9V4R6M3N1P5T7W2C"
}
{
  "error": "invalid_api_key",
  "message": "API key is invalid or has been revoked",
  "request_id": "01J2ZK8Q7X9V4R6M3N1P5T7W2C"
}

Was this page helpful?