Manage API Keys with the Platform API

List, inspect and delete GraphOS API keys programmatically

You can manage API keys with the Rover CLI or the GraphOS Platform API. This page documents Platform API operations for key lifecycle tasks.

For Rover commands, see the Rover api-key documentation.

List all API keys

To view all keys in your organization, use the apiKeys query:

GraphQL
query ApiKeys($organizationId: ID!) {
  organization(id: $organizationId) {
    apiKeys {
      totalCount
      nodes {
        createdAt
        expiresAt
        id
        keyName
        resources {
          resourceId
          resourceType
        }
        token
      }
    }
  }
}

Include a request payload with the following properties, using your own values:

GraphQL
Request payload
{
  "organizationId": "test-organization-id"
}

Example response payload:

GraphQL
Response payload
{
  "data": {
    "organization": {
      "apiKeys": {
        "totalCount": 2,
        "nodes": [
          {
            "createdAt": "2025-08-22T16:39:55.333903000Z",
            "expiresAt": "2026-08-22T16:40:17.876252636Z",
            "id": "00f8a1f8-53cb-47b9-b6f8-9a12d94d101f",
            "keyName": "Subgraph Test Key 1",
            "resources": [
              {
                "resourceId": "test-graph-id:staging:test-subgraph-name",
                "resourceType": "SUBGRAPH"
              },
              {
                "resourceId": "test-graph-id:staging:another-subgraph",
                "resourceType": "SUBGRAPH"
              }
            ]
          },
          {
            "createdAt": "2025-08-26T17:40:17.992591000Z",
            "expiresAt": "2026-08-26T17:40:17.876252636Z",
            "id": "982e5fbf-bbe6-4efa-bf05-0ce9fd5110ab",
            "keyName": "Subgraph Test Key 2",
            "resources": [
              {
                "resourceId": "test-graph-id:prod:test-subgraph-name",
                "resourceType": "SUBGRAPH"
              }
            ]
          }
        ]
      }
    }
  }
}

View a single API key's details

To view a single subgraph API key, use the apiKey query with the keyId of the key you want to view.

You can read keyId from the response when you first create the key or from the id field when you list all API keys.

GraphQL
query ApiKey($keyId: ID!, $organizationId: ID!) {
  organization(id: $organizationId) {
    apiKey(keyId: $keyId) {
      createdAt
      expiresAt
      id
      keyName
      resources {
        resourceId
        resourceType
      }
    }
  }
}

Include a request payload with the following properties, using your own values:

GraphQL
Request payload
{
  "keyId": "982e5fbf-bbe6-4efa-bf05-0ce9fd5110ab",
  "organizationId": "test-organization-id"
}

Example response payload:

GraphQL
Response payload
{
  "data": {
    "organization": {
      "apiKey": {
        "createdAt": "2025-08-26T17:40:17.992591000Z",
        "expiresAt": "2026-08-26T17:40:17.876252636Z",
        "id": "982e5fbf-bbe6-4efa-bf05-0ce9fd5110ab",
        "keyName": "Subgraph test key",
        "resources": [
          {
            "resourceId": "test-graph-id:prod:test-subgraph-name",
            "resourceType": "SUBGRAPH"
          }
        ]
      }
    }
  }
}

Delete an API key using the Platform API

caution
Key deletion is permanent and can't be undone.

To delete an API key, use the deleteKey mutation from the Platform API.

GraphQL
mutation DeleteKey($keyId: ID!, $organizationId: ID!) {
  organization(id: $organizationId) {
    deleteKey(keyId: $keyId)
  }
}

Include a request payload with the following properties, using your own values:

GraphQL
Request payload
{
  "keyId": "982e5fbf-bbe6-4efa-bf05-0ce9fd5110ab",
  "organizationId": "test-organization-id"
}

Example response payload for a successful deletion (returns the deleted keyId):

GraphQL
Response payload
{
  "data": {
    "organization": {
      "deleteKey": "982e5fbf-bbe6-4efa-bf05-0ce9fd5110ab"
    }
  }
}

Store API keys

After you create an API key, store the token value in your secret manager of choice. You can't view an API key's value after you create it.

For an overview of all key types, see API Keys.
Feedback

Ask Community