---
title: keys.list | Doing Work API
description: List a shop's named agent keys (owner only): label, scopes, audience, when made, last used and revoked. The key itself is never returned. Filter by audienc
url: https://doingwork.work/docs/reference/keys-list/
---

# keys.list

List a shop's named agent keys (owner only): label, scopes, audience, when made, last used and revoked. The key itself is never returned. Filter by audience (any or mcp) or include revoked keys.

|  |  |
|---|---|
| Who | Agents can call this |
| REST | `GET /v1/keys` |
| MCP tool | `keys_list` |
| Writes | no |
| Area | [Sign-in and agent access](https://doingwork.work/docs/reference/#sign-in-and-agent-access) |

## When to use it

The owner makes a key for each agent they use, with a name they will recognize. The key is shown once and never again, so save it when it is made.

## What to tell the owner

Tell them what you found in plain words. Don't read back raw fields.

## Input

| Field | Type | Required |
|---|---|---|
| `shop_id` | string | yes |
| `audience` | string (one of any, mcp) | no |
| `include_revoked` | boolean | no |

## Example

```http
GET https://doingwork.work/v1/keys?shop_id=00000000-0000-4000-8000-000000000000
```

## Output

JSON. The response shape isn't published yet; read the fields you need and ignore the rest. Errors are `{code, message, status}`.

## Errors

| Code | Status | What to do |
|---|---|---|
| `invalid_input`, `invalid_token`, `rate_limited` |  | Can happen on any call. See [errors](https://doingwork.work/docs/errors/). |