# Lists merchant API keys

<span class="api-endpoint">GET {{<a href="#urlbases">baseURL</a>}}/pay-api/v1/merchants/tokens</span>
This endpoint lists merchant API keys created for merchants under a partner account.
The query parameter filter may be used to further specify API keys to return.
This endpoint requires the API token to be from a partner API key.
API tokens generated from a merchant key are not accepted.

Endpoint: GET /pay-api/v1/merchants/tokens
Version: V1
Security: Bearer

## Query parameters:

  - `merchantId` (string)
    Specifies the identifier of the merchant.

If null or omitted, all merchants from the partner aer returned.

## Response 200 fields (application/json):

  - `tokens` (array)
    Specifies an array of objects identifying a list API keys.
These API keys were created for merchants under a partner account or as a standalone merchant.

  - `tokens.merchantId` (string)
    Indicates the merchant identifier of the API key.

Example: fae7620d-ab02-4375-bc20-6ff326b917fd
    Example: fae7620d-ab02-4375-bc20-6ff326b917fd

  - `tokens.tokenName` (string)
    Indicates the name of the API key.

This is a free-formed descriptive name to more easily identify the API key.

Example: Peppared Street Cafe's API Key
    Example: Peppared Street Cafe's API Key

  - `tokens.clientId` (string)
    The clientId or the first value association with the API key.

This is the public portion of the API key.
The second value association with the API key, the client secret, is never shown after the initial creation.

Example: 3b87fab4-5be4-44d3-9070-5f6ec1dfcbf5
    Example: 3b87fab4-5be4-44d3-9070-5f6ec1dfcbf5

  - `tokens.creationDate` (string)
    Specifies the creation date of the API key (in an ISO 8601 date-time UTC format).

Examples: 2026-02-19T20:24:52.934Z
    Example: 2026-02-19T20:24:52.934Z

## Response 400 fields (application/json):

  - `details` (string)
    Indicates details about the error.

Example: Validation failed: -- Email: 'Email' is not a valid email address. Severity: Error
    Example: Validation failed: -- Email: 'Email' is not a valid email address. Severity: Error

  - `statusCode` (integer)
    Specifies the HTTP response status code.
This is the HTTP status code returned by the attempted delivery.
The following is a list of HTTP response status codes that include but are not limited to:
| HTTP Status | Meaning |
|  --- | --- |
| 200 | Delivery succeeded |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Endpoint not found |
| 429 | Rate limited |

Example: 401
    Example: 401

  - `source` (string)
    Indicates the source of the error.
Example: <Service>
    Example: <Service>

  - `exceptionType` (string)
    Indicates the error's exception type.

Example: FluentValidation.ValidationException
    Example: FluentValidation.ValidationException

  - `correlationId` (string)
    Indicates the correlation identifier.

Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef
    Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef

  - `entityId` (string)
    Indicates the entity identifier.
Example:
null

  - `errorCode` (string)
    Indicates the error code.
Example:
null

## Response 404 fields (application/json):

  - `details` (string)

  - `statusCode` (integer)
    Specifies the HTTP response status code.
This is the HTTP status code returned by the attempted delivery.
The following is a list of HTTP response status codes that include but are not limited to:
| HTTP Status | Meaning |
|  --- | --- |
| 200 | Delivery succeeded |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Endpoint not found |
| 429 | Rate limited |

Example: 401
    Example: 401

  - `source` (string)

  - `exceptionType` (string)

  - `correlationId` (string)

  - `entityId` (string)

  - `errorCode` (string)

## Response 500 fields (application/json):

  - `details` (string)

  - `statusCode` (integer)
    Specifies the HTTP response status code.
This is the HTTP status code returned by the attempted delivery.
The following is a list of HTTP response status codes that include but are not limited to:
| HTTP Status | Meaning |
|  --- | --- |
| 200 | Delivery succeeded |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Endpoint not found |
| 429 | Rate limited |

Example: 401
    Example: 401

  - `source` (string)

  - `exceptionType` (string)

  - `correlationId` (string)

  - `entityId` (string)

  - `errorCode` (string)