# List a Realtime app's keys

`GET /v1/realtime/apps/{realtime_app_id}/keys`

Returns the app's keys, oldest first. Non-revoked only by default; pass include_revoked=true to include revoked keys. An app can hold several keys at once (create a new key, roll it out, then revoke the old one for zero-downtime rotation). Secrets are never included in this response.

## Code samples

**CLI**

```sh
bird realtime apps keys list <realtime-app-id>
```

Examples: [CLI](/docs/api/reference/list-realtime-app-keys.cli.md) · [MCP](/docs/api/reference/list-realtime-app-keys.mcp.md) · [cURL](/docs/api/reference/list-realtime-app-keys.curl.md)

## Example response `200`

```json
{
  "data": [
    {
      "id": "rak_01krdgeqcxet5s7t44vh8rt9mg",
      "key": "d0e95a856ddc1b09d4c8",
      "secret": "862925e1991a8b6902f9"
    }
  ]
}
```

## Path parameters

- `realtime_app_id` (string): ID of the Realtime app (`rap_` prefix), as returned when the app was created.

## Query parameters

- `include_revoked` (boolean): When true, include revoked keys in the response.

## Response body

- `data` (array of object, required): The app's keys, oldest first. Revoked keys are excluded unless `include_revoked`=`true`.
- `data.id` (string, required)
- `data.key` (string, required): The public app key clients use to connect.
- `data.secret` (string): The key secret, used for server-side request signing. Returned only when the key is created, and never shown again: store it securely. If lost, create a new key and revoke this one.
- `data.revoked_at` (nullable string, required): When the key was revoked, or `null` if still active.
- `data.created_at` (string, required)

## Related resources

- [Realtime](/realtime-api) (product)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first realtime event](/docs/get-started/send-your-first-realtime-event) (docs)

[Get an implementation brief](/learn/workspace?topic=realtime)