List API keys
Returns every secret API key in the workspace, in all environments. The response never includes the tokens, only a short prefix of each.
Requires a management key.
bearerAuthorizationBearer <token>Send a credential in the Authorization header: Authorization: Bearer <token>.
Each credential belongs to one environment of one workspace, so the API never takes a workspace or environment in the URL.
- Management key (
ffk_…, secret): manages flags, segments, environments, and API keys, and reads the audit log and analytics. It can also do everything an evaluation key can. - Evaluation key (
ffk_…, secret): for server SDKs. It evaluates flags, reads flag definitions for local evaluation, and sends telemetry. - Public token (
ffp_…, not secret): for browser and mobile apps. It evaluates flags through OFREP and sends telemetry. It cannot read flag definitions.
Keep secret keys on your server. A 401 response means the credential is missing or not valid. A 403 response means the credential is valid but its role cannot perform the operation.
OK
application/json- response
[index: integer]?A secret API key. Listing never returns the token itself, only its prefix.
curl -X GET 'https://api.toggld.io/api/v1/keys'[ { "id": "key_8a1d4c7e-2b5f-4e9a-9c3d-6f0b1a2e4d8c", "tenantId": "t_5b9e2c4a-8f1d-4a7c-b3e6-9d0c2f5a8b1e", "environmentId": "env_3f6b2a9c-1d4e-4f7a-8b2c-5e9d0a1f3c7b", "name": "Checkout service", "role": "evaluation", "prefix": "ffk_VIGOVS", "createdAt": "2026-05-01T12:00:00.000Z" }]Delete an environment DELETE
Permanently deletes an environment, with its flag configuration, API keys, and public token. Requests that use those credentials then fail with `401`. Requires a management key. Returns `404` if the environment does not exist. Returns `409` if it is the only environment in the workspace.
Create an API key POST
Creates a secret API key for one environment. `environment` is required. The response includes the token. This is the only time the API returns it, so store it securely. Requires a management key. Returns `404` if the environment does not exist.