API keys
X API key management: list active Xquik keys
List Xquik API keys for X API authentication. Review each key ID, name, safe prefix, active state, creation time & last use before rotation or revocation.
- 200
- 400
- 401
- 429
GET
X API key management: list active Xquik keys
Audit Xquik API keys before X automation
List every Xquik key registered to the signed-in account. Review keys before running tweet searches, follower exports, webhooks, monitors, or X writes. This endpoint returns key inventory metadata. It never returns a complete API key. Useid for revocation and prefix for safe identification.
The key list answers 5 operational questions:
- Which named Xquik keys exist on this account?
- Which keys are active or revoked?
- When was each key created?
- When did each key last authenticate a request?
- Which key ID should a rotation workflow revoke?
Free. This endpoint does not consume credits.
Read the API key inventory
Treat the response as an account credential inventory. Never treat it as a secret recovery endpoint.lastUsedAt is optional. Its absence means Xquik recorded no authenticated use.
Xquik refreshes it at most once a minute, so it can trail the latest call by up
to 60 seconds.
It does not prove that a deployment no longer needs the key.
Check scheduled jobs before revoking a quiet key. A monthly follower export
can remain valid without recent requests. Confirm the owner and workload first.
Distinguish Xquik keys from official X credentials
An Xquik API key starts withxq_. It authenticates requests to Xquik routes.
It is not an official Twitter API key or X developer bearer token.
Official X documentation separates application keys from bearer tokens. Read
its authentication overview
when integrating directly with the X developer platform.
Use Xquik authentication for Xquik request
headers. Use this list endpoint only for Xquik credential inventory.
Rotate an Xquik API key
Create the replacement before revoking the current key. This overlap prevents failed tweet, follower, webhook, and monitor requests.- List keys and record the current
id,name, andprefix. - Create a replacement key with a clear name.
- Store the returned
fullKeyin an approved secret manager. - Update one deployment without logging the replacement value.
- Send a planned Xquik request from that deployment.
- List keys and verify the replacement
lastUsedAtvalue. - Revoke the old key by its exact
id. - List keys again and confirm the old key is inactive.
isActive as the documented
key state.
Common X API key questions
Can I recover my full Xquik API key?
No.GET /api-keys returns only a safe prefix. The creation response returns
fullKey once. Create a replacement when the stored secret is unavailable.
Can an API key list other Xquik keys?
No. This management endpoint requires a same-origin dashboard session. Anx-api-key header or OAuth bearer token cannot authorize the request.
How do I check which Xquik key is active?
Match the deployed key prefix withprefix. Then check isActive. Never print
the complete deployed key during this comparison.
What does a missing last-used time mean?
The key has no recorded authenticated request. It may be new or unused. Check the intended workload before revocation.Does this endpoint list official Twitter API keys?
No. It lists Xquik keys for Xquik endpoints. Manage official X developer credentials in the X developer console.Headers
string
Dashboard session cookie. Format:
session_token=YOUR_SESSION_TOKEN.Query parameters
integer
Maximum items per page: 1 to 200, default 200.
string
nextCursor from the previous page. The after alias also works. Offset pagination is not
supported.Response
200 OK
array
Array of API key objects.
Key object fields.
string
Unique identifier for the API key.
string
Display name of the key.
string
First 8 characters of the key including the
xq_ prefix (for example "xq_a1b2").boolean
Whether the key is active.
string
ISO 8601 creation timestamp.
string
ISO 8601 timestamp of the last API call made with this key, refreshed at most once a minute. Omitted if never used.
boolean
Whether more rows follow this page.
string
Pass it as
cursor for the next page. Present when hasMore is true.400 Invalid cursor
cursor is not one this list returned. Send the nextCursor of the previous page, or omit it.
401 Unauthenticated
429 Rate limited
Retry-After header before retrying.
API key listing requires a same-origin dashboard session. API keys and OAuth
bearer tokens cannot list account keys.Related. Create API Key · Revoke API Key