API keys

$envless->keys->get()

Read one API key by id

php
/** @return KeyResource */
public function get(string $id, int|float|null $timeout = null): array

Returns a single key. Read it before you revoke something you believe is unused: active tells you whether it is currently enabled, scopes is the effective map after clamping rather than what was requested, projectIds is the project fence, and lastUsedAt is the only evidence of live traffic.

id is the key id from a list call or from create. It is not the prefix and not the secret, and keys have no slug form, so a prefix passed here produces a 404 rather than a validation error.

The secret is never returned, on this route or any other. If the plaintext is lost the key is unrecoverable and the only path forward is to create a replacement and delete this one.

Example

php
use Envless\Envless;

$envless = new Envless();

$key = $envless->keys->get('0191f3c2-8a71-7c3e-9b2d-4f5a6c7d8e90');

echo "{$key['prefix']} {$key['lastUsedAt']}", PHP_EOL;
echo implode(', ', array_keys($key['scopes'])), PHP_EOL;

Parameters

ParameterTypeRequiredDescription
$idstringYesThe key id, ids only, no prefix and no slug form.
$timeoutint|floatNoSeconds each attempt of this call may take, the response body included, before it throws Envless\Exception\NetworkException with isTimeout() true. Overrides the client's timeout for this call, and 0 turns the limit off.

Returns

KeyResource with prefix, effective scopes, projectIds, active and lastUsedAt.

Worth knowing

  • A key that delete has already revoked returns 404 key.not_found, so a 404 here is a reliable revoked signal.
  • lastUsedAt is null for a key that has never authenticated a request.

Required scopes

keys:read

Underlying endpoint

GET /keys/{id}

Request and response schema, every error code, and a live playground.

In TypeScript

envless.keys.get()

The same method in @goenvless/sdk, with the same request, retries and errors.