get-key

Retrieve detailed information about an API key using the Unkey CLI including metadata, permissions, rate limits, and remaining credits.

Retrieve detailed key information for dashboard interfaces and administrative purposes.

Use this to build key management dashboards showing users their key details, status, permissions, and usage data. You can identify keys by keyId or the actual key string.

Important: Set decrypt: true only in secure contexts to retrieve plaintext key values from recoverable keys.

Required permissions:

• api.*.read_key or api.<api_id>.read_key (to read key information)
• api.*.decrypt_key or api.<api_id>.decrypt_key (additionally required when using --decrypt)

See the API reference for the full HTTP endpoint documentation.

Usage

unkey api keys get-key [flags]

Flags

--key-id · string · required

The database identifier of the key to retrieve, returned from keys.createKey. Do not confuse this with the actual API key string that users include in requests. Find this ID in creation responses, key listings, dashboard, or verification responses.

--decrypt · boolean · default: "false"

Whether to include the plaintext key value in the response. Only works for keys created with recoverable=true and requires the decrypt_key permission. Returned keys must be handled securely — never logged, cached, or stored insecurely.

Global Flags

Flag	Type	Description
--root-key	string	Override root key ($UNKEY_ROOT_KEY)
--api-url	string	Override API base URL (default: https://api.unkey.com)
--config	string	Path to config file (default: ~/.unkey/config.toml)
--output	string	Output format. Use json for raw JSON
--body	string	Send this JSON string as the request body. You cannot combine it with request-building flags.

Examples

Basic

unkey api keys get-key --key-id=key_1234abcd

Output

Default output shows the request ID, followed by the key details:

req_2c9a0jf23l4k567

{
  "keyId": "key_1234abcd",
  "start": "sk_prod",
  "enabled": true,
  "name": "Production API Key",
  "createdAt": 1704067200000,
  "permissions": [
    "documents.read",
    "documents.write"
  ],
  "roles": [
    "editor"
  ]
}

With --output=json, the full response envelope is returned:

{
  "meta": {
    "requestId": "req_2c9a0jf23l4k567"
  },
  "data": {
    "keyId": "key_1234abcd",
    "start": "sk_prod",
    "enabled": true,
    "name": "Production API Key",
    "createdAt": 1704067200000,
    "permissions": [
      "documents.read",
      "documents.write"
    ],
    "roles": [
      "editor"
    ]
  }
}