---
title: Retrieve API Key (Admin API)
url: https://platform.claude.com/docs/en/api/go/beta/organization/api_keys/retrieve
---

# Retrieve API Key (Admin API)

`client.Beta.Organization.APIKeys.Get(ctx, apiKeyID) (*BetaAPIKey, error)`

**GET** `/v1/organizations/api_keys/{api_key_id}`

Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console.

## Parameters

- `apiKeyID string` (path parameter)

  ID of the API key.

## Returns

- `type BetaAPIKey`

  - `Type APIKey`

    Object type.

    For API Keys, this is always `"api_key"`.

    default: api_key

  - `ID string`

    ID of the API key.

  - `CreatedAt Time`

    RFC 3339 datetime string indicating when the API Key was created.

    format: date-time

  - `CreatedBy BetaAPIKeyCreatedBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

    - `Type BetaAPIKeyCreatedByType`

      Type of the actor that created the object.

      - `const BetaAPIKeyCreatedByTypeServiceAccount BetaAPIKeyCreatedByType = "service_account"`

      - `const BetaAPIKeyCreatedByTypeUser BetaAPIKeyCreatedByType = "user"`

    - `ID string`

      ID of the actor that created the object.

  - `ExpiresAt Time`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

    format: date-time

  - `Name string`

    Name of the API key.

  - `PartialKeyHint string`

    Partially redacted hint for the API key.

  - `Principal BetaAPIKeyPrincipalUnion`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

    - `type BetaAPIKeyUserActor`

      - `Type UserActor`

        Principal type. Always `"user_actor"` for a User.

        default: user_actor

      - `UserID string`

        ID of the User the API key acts as.

    - `type BetaAPIKeyServiceAccountActor`

      - `Type ServiceAccountActor`

        Principal type. Always `"service_account_actor"` for a Service Account.

        default: service_account_actor

      - `ServiceAccountID string`

        ID of the Service Account the API key acts as.

  - `Scope BetaAPIKeyScopeUnion`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

    - `type BetaAPIKeyOrganizationScope`

      - `Type Organization`

        Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.

        default: organization

    - `type BetaAPIKeyWorkspaceScope`

      - `Type Workspace`

        Scope type. Always `"workspace"`: the API key belongs to one Workspace.

        default: workspace

      - `WorkspaceID string`

        ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.

  - `Status BetaAPIKeyStatus`

    Status of the API key.

    - `const BetaAPIKeyStatusActive BetaAPIKeyStatus = "active"`

    - `const BetaAPIKeyStatusArchived BetaAPIKeyStatus = "archived"`

    - `const BetaAPIKeyStatusExpired BetaAPIKeyStatus = "expired"`

    - `const BetaAPIKeyStatusInactive BetaAPIKeyStatus = "inactive"`

  - `WorkspaceID string`

    **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.

    Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.

## Example

```go
package main

import (
	"context"
	"fmt"

	"github.com/anthropics/anthropic-sdk-go"
	"github.com/anthropics/anthropic-sdk-go/option"
)

func main() {
	client := anthropic.NewClient(
		option.WithAPIKey("my-anthropic-api-key"),
	)
	betaAPIKey, err := client.Beta.Organization.APIKeys.Get(context.TODO(), "api_key_id")
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", betaAPIKey.ID)
}
```

### Response (200)

```json
{
  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by": {
    "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
    "type": "user"
  },
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "name": "Developer Key",
  "partial_key_hint": "sk-ant-api03-R2D...igAA",
  "principal": {
    "type": "user_actor",
    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
  },
  "scope": {
    "type": "workspace",
    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
  },
  "status": "active",
  "type": "api_key",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```