API keys
X API key management: list active Xquik keys
List Xquik API keys for X API authentication. Review each key ID, name, safe prefix, active state, creation time & last use before rotation or revocation.
- 200
- 401
- 429
GET
X API key management: list active Xquik keys
Audit Xquik API keys before X automation
List every Xquik key registered to the signed-in account. Review keys before running tweet searches, follower exports, webhooks, monitors, or X writes. This endpoint returns key inventory metadata. It never returns a complete API key. Useid for revocation and prefix for safe identification.
The key list answers 5 operational questions:
- Which named Xquik keys exist on this account?
- Which keys are active or revoked?
- When was each key created?
- When did each key last authenticate a request?
- Which key ID should a rotation workflow revoke?
Free - does not consume credits
Read the API key inventory
Treat the response as an account credential inventory. Never treat it as a secret recovery endpoint.lastUsedAt is optional. Its absence means no authenticated use was recorded.
It does not prove that a deployment no longer needs the key.
Check scheduled jobs before revoking a quiet key. A monthly follower export
can remain valid without recent requests. Confirm the owner and workload first.
Distinguish Xquik keys from official X credentials
An Xquik API key starts withxq_. It authenticates requests to Xquik routes.
It is not an official Twitter API key or X developer bearer token.
Official X documentation separates application keys from bearer tokens. Read
its authentication overview
when integrating directly with the X developer platform.
Use Xquik authentication for Xquik request
headers. Use this list endpoint only for Xquik credential inventory.
Rotate an Xquik API key safely
Create the replacement before revoking the current key. This overlap prevents failed tweet, follower, webhook, and monitor requests.- List keys and record the current
id,name, andprefix. - Create a replacement key with a clear name.
- Store the returned
fullKeyin an approved secret manager. - Update one deployment without logging the replacement value.
- Send a planned Xquik request from that deployment.
- List keys and verify the replacement
lastUsedAtvalue. - Revoke the old key by its exact
id. - List keys again and confirm the old key is inactive.
isActive as the documented
key state.
Answer common X API key questions
Can I recover my full Xquik API key?
No.GET /api-keys returns only a safe prefix. The creation response returns
fullKey once. Create a replacement when the stored secret is unavailable.
Can an API key list other Xquik keys?
No. This management endpoint requires a same-origin dashboard session. Anx-api-key header or OAuth bearer token cannot authorize the request.
How do I check which Xquik key is active?
Match the deployed key prefix withprefix. Then check isActive. Never print
the complete deployed key during this comparison.
What does a missing last-used time mean?
The key has no recorded authenticated request. It may be new or unused. Check the intended workload before revocation.Does this endpoint list official Twitter API keys?
No. It lists Xquik keys for Xquik endpoints. Manage official X developer credentials in the X developer console.Headers
string
Dashboard session cookie. Format:
session_token=YOUR_SESSION_TOKEN.Response
200 OK
array
Array of API key objects.
Key object fields.
string
Unique identifier for the API key.
string
Display name of the key.
string
First 8 characters of the key including the
xq_ prefix (e.g. "xq_a1b2").boolean
Whether the key is currently active.
string
ISO 8601 creation timestamp.
string
ISO 8601 timestamp of the last API call made with this key. Omitted if never used.
401 Unauthenticated
429 Rate limited
Retry-After header before retrying.
API key listing requires a same-origin dashboard session. API keys and OAuth
bearer tokens cannot list account keys.Related. Create API Key · Revoke API Key
- 200
- 401
- 429
X API key management: list active Xquik keys