mailerpress-pro/list-embed-keys returns every embed-form API key with its metadata: name, allowed domain, status and rate limits.
The raw key value is only ever returned at creation time. Never here.
At a glance
| Ability | mailerpress-pro/list-embed-keys |
| Toolset | MailerPress Pro — toolset/mailerpress-pro |
| Group | MailerPress Pro › Embed Keys |
| Requires | AcrossAI Pro, plus MailerPress with its Pro add-on active on the site |
| Capability | manage_options |
| Safety | Read-only — changes nothing |
| Repeatable | Idempotent — running it twice leaves the same result |
| Ships in | AcrossAI Pro 0.9.16 and later |
How it works
An embed key lets a form on another site submit into this contact list. The key travels in the embed, which means it is visible to anyone who views the source of the page hosting it — it is a public identifier with a scope, not a secret.
That is why the allowed domain matters more than the key’s secrecy. The domain restriction is what stops a copied key working from somewhere else, and a key with no domain restriction is usable by anybody who found it.
Rate limits are the second control, and the one that matters against abuse rather than misuse: a key without one can be used to hammer the list.
So the audit question here is not “are the keys secret” but “is each key scoped”. The status, domain and limits together answer it.
Read-only.
Input
This ability takes no input.
What comes back
| Name | Type | What it is |
|---|---|---|
keys | array | Each key with its name, allowed domain, status and rate limits. No raw key value. |
success | boolean | Whether the call completed. |
message | string | A one-line summary of what happened, suitable for showing a human. |
error_code | string | Present only on failure — a stable machine-readable reason, such as a missing field, a wrong field type or an unmet confirmation. |
Example
Ask your assistant:
What embed keys exist and where can they be used?
It resolves to one call:
{
"ability": "mailerpress-pro/list-embed-keys",
"parameters": {}
}Worth knowing
- An embed key is visible in the page source. It is scoped, not secret.
- The allowed domain is the real control.
- A key with no domain restriction works from anywhere.
- The raw value is never returned here.
Related abilities
- MailerPress Pro Create Embed Key — issue one
- MailerPress Pro Update Embed Key — tighten the scope
Get the plugins:
AcrossAI Abilities Manager · AcrossAI MCP Manager
Browse the rest: Every ability, by category