Skip to main content
GET
X API key management: list active Xquik keys

Audit Xquik API keys before X automation

List every Xquik key registered to the signed-in account. Review keys before running tweet searches, follower exports, webhooks, monitors, or X writes. This endpoint returns key inventory metadata. It never returns a complete API key. Use id for revocation and prefix for safe identification. The key list answers 5 operational questions:
  • Which named Xquik keys exist on this account?
  • Which keys are active or revoked?
  • When was each key created?
  • When did each key last authenticate a request?
  • Which key ID should a rotation workflow revoke?
Free - does not consume credits

Read the API key inventory

Treat the response as an account credential inventory. Never treat it as a secret recovery endpoint. lastUsedAt is optional. Its absence means no authenticated use was recorded. It does not prove that a deployment no longer needs the key. Check scheduled jobs before revoking a quiet key. A monthly follower export can remain valid without recent requests. Confirm the owner and workload first.

Distinguish Xquik keys from official X credentials

An Xquik API key starts with xq_. It authenticates requests to Xquik routes. It is not an official Twitter API key or X developer bearer token. Official X documentation separates application keys from bearer tokens. Read its authentication overview when integrating directly with the X developer platform. Use Xquik authentication for Xquik request headers. Use this list endpoint only for Xquik credential inventory.

Rotate an Xquik API key safely

Create the replacement before revoking the current key. This overlap prevents failed tweet, follower, webhook, and monitor requests.
  1. List keys and record the current id, name, and prefix.
  2. Create a replacement key with a clear name.
  3. Store the returned fullKey in an approved secret manager.
  4. Update one deployment without logging the replacement value.
  5. Send a planned Xquik request from that deployment.
  6. List keys and verify the replacement lastUsedAt value.
  7. Revoke the old key by its exact id.
  8. List keys again and confirm the old key is inactive.
OWASP treats creation, rotation, revocation, and expiration as a secret lifecycle. Review its secrets management guidance when defining your organization policy. The Xquik list response does not expose scopes or expiration fields. Do not invent those controls from names or prefixes. Use isActive as the documented key state.

Answer common X API key questions

Can I recover my full Xquik API key?

No. GET /api-keys returns only a safe prefix. The creation response returns fullKey once. Create a replacement when the stored secret is unavailable.

Can an API key list other Xquik keys?

No. This management endpoint requires a same-origin dashboard session. An x-api-key header or OAuth bearer token cannot authorize the request.

How do I check which Xquik key is active?

Match the deployed key prefix with prefix. Then check isActive. Never print the complete deployed key during this comparison.

What does a missing last-used time mean?

The key has no recorded authenticated request. It may be new or unused. Check the intended workload before revocation.

Does this endpoint list official Twitter API keys?

No. It lists Xquik keys for Xquik endpoints. Manage official X developer credentials in the X developer console.

Headers

Dashboard session cookie. Format: session_token=YOUR_SESSION_TOKEN.

Response

200 OK

array
Array of API key objects. Key object fields.
string
Unique identifier for the API key.
string
Display name of the key.
string
First 8 characters of the key including the xq_ prefix (e.g. "xq_a1b2").
boolean
Whether the key is currently active.
string
ISO 8601 creation timestamp.
string
ISO 8601 timestamp of the last API call made with this key. Omitted if never used.

401 Unauthenticated

Missing, expired, or invalid dashboard session cookie.

429 Rate limited

Too many requests. Wait for the Retry-After header before retrying.
API key listing requires a same-origin dashboard session. API keys and OAuth bearer tokens cannot list account keys.Related. Create API Key · Revoke API Key