---
title: "Update LLM Provider's ApiKey"
method: PATCH
path: "/v1/private/llm-provider-key/{id}"
tags: ["LlmProviderKey"]
---

# Update LLM Provider's ApiKey

`PATCH /v1/private/llm-provider-key/{id}`

Update LLM Provider's ApiKey. api_key and auth_config are mutually exclusive: setting a valid auth_config on a provider that holds a static api_key clears the stored key; send auth_config as an empty object to clear the recipe and switch back to a static key

## Path parameters

- `id` string, uuid, required

## Request body

- ProviderApiKeyUpdate
  - `api_key` string
  - `name` string
  - `provider_name` string — Provider name - can be set to migrate legacy custom LLM or Bedrock providers to the new multi-provider format. Once set, it cannot be changed. Should only be set for custom LLM and Bedrock providers.
  - `headers` object
  - `configuration` object
  - `base_url` string
  - `auth_config` ProviderAuthConfig — Dynamic token auth recipe. Send the '__SECRET__' sentinel as a credential value to keep the stored secret; send an empty object to clear the auth config.
    - `token_url` string — Auth service URL the credentials are sent to
    - `send_as` 'form' | 'json' | 'basic' — How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body)
    - `credentials` Credential[] — Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
      - `key` string, required
      - `value` string
      - `secret` boolean — Secret values are encrypted at rest and never read back; once true it cannot be unset
    - `token_field` string — Field holding the token in the reply; dot-path for nested replies
    - `expires_field` string — Field holding the token lifetime in seconds in the reply; dot-path for nested replies
    - `fallback_ttl_seconds` integer — Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins

## Response `204`

No Content

## Other responses

- `401` — Bad Request
- `403` — Access forbidden
- `404` — Not found

## Changes

- **2026-08-26** `0739fa5022ca` — 1 info
  - added the new optional request property `auth_config`

[Change history](https://skmtc.dev/comet-ml/apis/opik-rest-api/changes/v1/private/llm-provider-key/:id/patch.md)

---

[API](https://skmtc.dev/comet-ml/apis/opik-rest-api.md) · [All operations](https://skmtc.dev/comet-ml/apis/opik-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/comet-ml/apis/opik-rest-api/revisions/3ab3b8180ae9?raw)