diff --git a/unraid_mcp/tools/keys.py b/unraid_mcp/tools/keys.py
index c5f08bc..f59ee0e 100644
--- a/unraid_mcp/tools/keys.py
+++ b/unraid_mcp/tools/keys.py
@@ -6,11 +6,21 @@ creating, updating, and deleting API keys.
 
 from typing import Any, Literal, get_args
 
+from fastmcp import Context as _Context
 from fastmcp import FastMCP
 
 from ..config.logging import logger
 from ..core.client import make_graphql_request
+from ..core.exceptions import CredentialsNotConfiguredError as _CredErr
 from ..core.exceptions import ToolError, tool_error_handler
+from ..core.setup import elicit_and_configure as _elicit
+
+
+# Re-export at module scope so tests can patch "unraid_mcp.tools.keys.elicit_and_configure"
+# and "unraid_mcp.tools.keys.CredentialsNotConfiguredError"
+elicit_and_configure = _elicit
+CredentialsNotConfiguredError = _CredErr
+Context = _Context
 
 
 QUERIES: dict[str, str] = {
@@ -75,6 +85,7 @@ def register_keys_tool(mcp: FastMCP) -> None:
         name: str | None = None,
         roles: list[str] | None = None,
         permissions: list[str] | None = None,
+        ctx: Context | None = None,
     ) -> dict[str, Any]:
         """Manage Unraid API keys.
 
@@ -95,7 +106,15 @@ def register_keys_tool(mcp: FastMCP) -> None:
             logger.info(f"Executing unraid_keys action={action}")
 
             if action == "list":
-                data = await make_graphql_request(QUERIES["list"])
+                try:
+                    data = await make_graphql_request(QUERIES["list"])
+                except CredentialsNotConfiguredError:
+                    configured = await elicit_and_configure(ctx)
+                    if not configured:
+                        raise ToolError(
+                            "Credentials required. Run `unraid_health action=setup` to configure."
+                        )
+                    data = await make_graphql_request(QUERIES["list"])
                 keys = data.get("apiKeys", [])
                 return {"keys": list(keys) if isinstance(keys, list) else []}