> For the complete documentation index, see [llms.txt](https://developers.make.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.make.com/api-documentation/api-reference/keys.md).
# Keys
The following endpoints allow you to manage and retrieve metadata for authentication keys in your custom keychain. You can use these keys to manage your authentication in the HTTP or encryptor apps similarly to other connections.
## List keys
> Gets the list of keys in your custom keychain. You can use the \`typeName\` query parameter to filter your keys based on their type. Run the \[list of key types]\(./get--keys--types.md) API call to get a list of available key types.
```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Keys","description":"The following endpoints allow you to manage and retrieve metadata for authentication keys in your custom keychain. You can use these keys to manage your authentication in the HTTP or encryptor apps similarly to other connections."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["keys:read"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/keys":{"get":{"tags":["Keys"],"summary":"List keys","description":"Gets the list of keys in your custom keychain. You can use the `typeName` query parameter to filter your keys based on their type. Run the [list of key types](./get--keys--types.md) API call to get a list of available key types.\n","parameters":[{"name":"teamId","description":"The ID of the team.","in":"query","schema":{"type":"integer"},"required":true},{"name":"typeName","in":"query","description":"Use the key type to get only keys with the specified type. You can use the API call `GET /keys/types` to list available key types.","schema":{"type":"string","enum":["aes-key","apikeyauth","apn","basicauth","clientcertauth","eet","gpg-private","gpg-public","webpay"]}},{"name":"cols[]","in":"query","description":"Specifies columns that are returned in the response. Use the `cols[]` parameter for each column that you want included. For example `GET /endpoint?cols[]=key1&cols[]=key2` to get both `key1` and `key2` columns in the response.\n\n[Check the \"Filtering\" section for a full example.](/api-documentation/pagination-sorting-filtering/filtering)\n","schema":{"type":"array","items":{"type":"string","enum":["id","name","typeName","teamId","packageName","theme","scenarioUsages"]}}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"keys":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"typeName":{"type":"string"},"teamId":{"type":"integer"},"packageName":{"type":"string"},"theme":{"type":"string","format":"color"},"scenarioUsages":{"type":"array","description":"Scenarios that use this key. Only returned when explicitly requested via `cols[]=scenarioUsages`.","items":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}}}}}}}}}}}}}}}}}
```
## Create a key
> Creates a key in your keychain.\
> \
> Use the \[list of key types]\(./get--keys--types.md) API call to get a list of available key types for the \`typeName\` parameter. Specify additional parameters in the \`parameters\` object based on the key type.
```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Keys","description":"The following endpoints allow you to manage and retrieve metadata for authentication keys in your custom keychain. You can use these keys to manage your authentication in the HTTP or encryptor apps similarly to other connections."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["keys:write"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/keys":{"post":{"tags":["Keys"],"summary":"Create a key","description":"Creates a key in your keychain.\n\n Use the [list of key types](./get--keys--types.md) API call to get a list of available key types for the `typeName` parameter. Specify additional parameters in the `parameters` object based on the key type.\n","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"teamId":{"type":"integer","description":"The ID of the team."},"name":{"type":"string","description":"The name of the key."},"typeName":{"type":"string","description":"Use the key type to get only keys with the specified type. You can use the API call `GET /keys/types` to list available key types."},"parameters":{"type":"object","description":"Additional parameters required to create the key.\n\nCheck the [list of key types](./get--keys--types.md) API call for the parameters you need to specify.\n"},"visibility":{"type":"string","enum":["team","locked"],"default":"team","description":"Entity-tier visibility of the created key. With `locked` the key is restricted to its access list from the moment it is created, with the creator as its sole admin. Requires the *Locked connections* feature to be enabled for the organization; otherwise the request fails with `IM903` (HTTP 400). When the access list cannot be provisioned, the request fails with HTTP 422 and the key is not created. Omitted or `team`, the key is visible to the whole team."}},"required":["teamId","name","typeName","parameters"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"key":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"typeName":{"type":"string"},"teamId":{"type":"integer"},"packageName":{"type":"string"},"theme":{"type":"string","format":"color"},"scenarioUsages":{"type":"array","description":"Scenarios that use this key. Only returned when explicitly requested via `cols[]=scenarioUsages`.","items":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}}}}}}}}}}},"400":{"description":"The `visibility` value is invalid (`IM005`), or `visibility: locked` was sent while the *Locked connections* feature is not enabled for the organization (`IM903`, returned while the `web_api_locked_connections` feature flag is off).\n"},"422":{"description":"The access list of a `locked` key could not be provisioned (`IM016`). The key is not created — the request can be retried.\n"}}}}}}
```
## List key types
> Gets the list of available key types.
```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Keys","description":"The following endpoints allow you to manage and retrieve metadata for authentication keys in your custom keychain. You can use these keys to manage your authentication in the HTTP or encryptor apps similarly to other connections."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["keys:read"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/keys/types":{"get":{"tags":["Keys"],"summary":"List key types","description":"Gets the list of available key types.","responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"keysTypes":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"label":{"type":"string"},"parameters":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"label":{"type":"string"},"type":{"type":"string"}}}},"componentType":{"type":"string"},"managed":{"type":"boolean","description":"When true, this key type is server-managed: its data is written only by a dedicated setup flow, and it is hidden from the generic key list unless explicitly requested via `?typeName=`. Absent/false for all other key types."},"creation":{"type":"object","description":"Describes how to create a key of this managed type. Only present when `managed` is true.","properties":{"mode":{"type":"string"},"url":{"type":"string"},"window":{"type":"object","properties":{"width":{"type":"integer"},"height":{"type":"integer"}}}}},"author":{"type":"string"},"version":{"type":"string"},"theme":{"type":"string","format":"color"},"icon":{"type":"string"}}}}}}}}}}}}}}
```
## Get key details
> Gets details of the specified key.
```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Keys","description":"The following endpoints allow you to manage and retrieve metadata for authentication keys in your custom keychain. You can use these keys to manage your authentication in the HTTP or encryptor apps similarly to other connections."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["keys:read"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/keys/{keyId}":{"get":{"tags":["Keys"],"summary":"Get key details","description":"Gets details of the specified key.","parameters":[{"name":"keyId","in":"path","schema":{"type":"integer"},"required":true,"description":"The ID of the key."},{"name":"cols[]","in":"query","description":"Specifies columns that are returned in the response. Use the `cols[]` parameter for every column that you want to return in the response. For example `GET /endpoint?cols[]=key1&cols[]=key2` to get both `key1` and `key2` columns in the response.\n\n[Check the \\\"Filtering\\\" section for a full example.](/api-documentation/pagination-sorting-filtering/filtering)\n","schema":{"type":"array","items":{"type":"string","enum":["id","name","typeName","teamId","packageName","theme"]}}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"key":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"typeName":{"type":"string"},"teamId":{"type":"integer"},"packageName":{"type":"string"},"theme":{"type":"string","format":"color"},"scenarioUsages":{"type":"array","description":"Scenarios that use this key. Only returned when explicitly requested via `cols[]=scenarioUsages`.","items":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}}}}}}}}}}},"403":{"description":"The key is restricted to its access list and the caller is not on it with permission to use it (`IM002`).\n"}}}}}}
```
## Delete a key
> Deletes the specified key. Use the \`confirmed\` parameter to confirm deleting the key. Otherwise, you get an error and the key is not deleted.
```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Keys","description":"The following endpoints allow you to manage and retrieve metadata for authentication keys in your custom keychain. You can use these keys to manage your authentication in the HTTP or encryptor apps similarly to other connections."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["keys:write"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/keys/{keyId}":{"delete":{"tags":["Keys"],"summary":"Delete a key","description":"Deletes the specified key. Use the `confirmed` parameter to confirm deleting the key. Otherwise, you get an error and the key is not deleted.","parameters":[{"name":"keyId","in":"path","schema":{"type":"integer"},"required":true,"description":"The ID of the key."},{"name":"confirmed","in":"query","schema":{"type":"boolean"},"description":"Set this parameter to `true` to confirm deleting the key. Otherwise, you get an error and the key is not deleted."}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"key":{"type":"integer"}}}}}},"403":{"description":"The key is restricted to its access list and the caller is not on it with permission to manage it (`IM002`). A team administrator may still delete such a key only when nobody is left able to manage it.\n"}}}}}}
```
## Update a key
> Updates a key \`name\`, connection parameters, or both with the data specified in the request body. If you don't specify a parameter, Make keeps the original value.\
> \
> Use the \`GET /key-types\` API call to find out which parameters you need to specify in the \`parameters\` object based on the key type.
```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Keys","description":"The following endpoints allow you to manage and retrieve metadata for authentication keys in your custom keychain. You can use these keys to manage your authentication in the HTTP or encryptor apps similarly to other connections."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["keys:write"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/keys/{keyId}":{"patch":{"tags":["Keys"],"summary":"Update a key","description":"Updates a key `name`, connection parameters, or both with the data specified in the request body. If you don't specify a parameter, Make keeps the original value.\n\nUse the `GET /key-types` API call to find out which parameters you need to specify in the `parameters` object based on the key type.\n","parameters":[{"name":"keyId","in":"path","schema":{"type":"integer"},"required":true,"description":"The ID of the key."}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"key":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"typeName":{"type":"string"},"teamId":{"type":"integer"},"packageName":{"type":"string"},"theme":{"type":"string","format":"color"},"scenarioUsages":{"type":"array","description":"Scenarios that use this key. Only returned when explicitly requested via `cols[]=scenarioUsages`.","items":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}}}}}}}}}}},"403":{"description":"The key is restricted to its access list and the caller is not on it with permission to manage it (`IM002`).\n"}}}}}}
```
## Lock key
> Restricts the key's visibility to its access list (\`visibility: locked\`). The caller becomes the sole admin\
> of the locked key.\
> \
> Caller rule: only the key's author can lock it, and that author must still be a member of the key's\
> team. A key without an author cannot be locked.\
> \
> The operation is idempotent — locking an already locked key succeeds without any change; the caller rule\
> above still applies.\
> \
> Requires the \*Locked connections\* feature to be enabled for the organization.
```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Keys","description":"The following endpoints allow you to manage and retrieve metadata for authentication keys in your custom keychain. You can use these keys to manage your authentication in the HTTP or encryptor apps similarly to other connections."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["keys:write"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/keys/{keyId}/make-locked":{"post":{"tags":["Keys"],"summary":"Lock key","description":"Restricts the key's visibility to its access list (`visibility: locked`). The caller becomes the sole admin\nof the locked key.\n\nCaller rule: only the key's author can lock it, and that author must still be a member of the key's\nteam. A key without an author cannot be locked.\n\nThe operation is idempotent — locking an already locked key succeeds without any change; the caller rule\nabove still applies.\n\nRequires the *Locked connections* feature to be enabled for the organization.\n","parameters":[{"name":"keyId","in":"path","schema":{"type":"integer"},"required":true,"description":"The ID of the key."}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"key":{"type":"object","properties":{"id":{"type":"integer","description":"The ID of the key."},"visibility":{"type":"string","enum":["locked"],"description":"The visibility of the key after the flip."}}}}}}}},"400":{"description":"The *Locked connections* feature is not enabled for the organization (`IM903`, returned while the `web_api_locked_connections` feature flag is off).\n"},"403":{"description":"The caller is not the key's author (`IM002`).\n"},"404":{"description":"The key does not exist (`IM013`)."},"409":{"description":"The key has no author, or its author is no longer a member of the key's team (`SC409`) — locking is reserved to an author who is still on the team.\n"}}}}}}
```
## Make key available to team
> Makes a locked key visible to the whole team again (\`visibility: team\`) and clears the key's entire access\
> list. Only an admin of the locked key can perform the flip. The key's author is not changed.\
> \
> The operation is idempotent — flipping an already team-visible key succeeds, provided the caller has the\
> \`key edit\` permission; any residual entries on the key's access list are still cleared.\
> \
> Requires the \*Locked connections\* feature to be enabled for the organization.
```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Keys","description":"The following endpoints allow you to manage and retrieve metadata for authentication keys in your custom keychain. You can use these keys to manage your authentication in the HTTP or encryptor apps similarly to other connections."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["keys:write"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/keys/{keyId}/make-team":{"post":{"tags":["Keys"],"summary":"Make key available to team","description":"Makes a locked key visible to the whole team again (`visibility: team`) and clears the key's entire access\nlist. Only an admin of the locked key can perform the flip. The key's author is not changed.\n\nThe operation is idempotent — flipping an already team-visible key succeeds, provided the caller has the\n`key edit` permission; any residual entries on the key's access list are still cleared.\n\nRequires the *Locked connections* feature to be enabled for the organization.\n","parameters":[{"name":"keyId","in":"path","schema":{"type":"integer"},"required":true,"description":"The ID of the key."}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"key":{"type":"object","properties":{"id":{"type":"integer","description":"The ID of the key."},"visibility":{"type":"string","enum":["team"],"description":"The visibility of the key after the flip."}}}}}}}},"400":{"description":"The *Locked connections* feature is not enabled for the organization (`IM903`, returned while the `web_api_locked_connections` feature flag is off).\n"},"403":{"description":"The caller is not an admin of the locked key (`IM002`)."},"404":{"description":"The key does not exist (`IM013`)."}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://developers.make.com/api-documentation/api-reference/keys.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.