---
title: "Update an API key"
method: POST
path: "/v1/api-keys/{id}"
tags: ["API Keys"]
---

# Update an API key

`POST /v1/api-keys/{id}`

## Request

- Base URL: `https://hcti.io`
- URL: `https://hcti.io/v1/api-keys/{id}`
- Auth: HTTP basic

Replaces the key's name, description, disabled state, and permissions. The caller must be able to grant both the existing and requested permissions. This also applies when disabling or re-enabling a key. Does not rotate or return the secret. Use id, not api_id.

**Rate limit:** 20 requests per minute per organization, shared across all operations in the `api-key:write` group and all API keys belonging to that organization.

## Path parameters

- `id` string, required

## Request body

- CreateOrUpdateApiKeyRequest: Configuration for creating or updating an API key. Updates replace the configuration; omitted optional settings are cleared or reset to their defaults.
  - `name` string, nullable: Display name for the key, up to 255 characters. Omitted, null, or blank names use Key created YYYY-MM-DD HH:mm:ss, based on the key's original creation time in UTC.
  - `description` string, nullable: Optional description of the key's purpose, up to 2000 characters. Omitted, null, or blank clears the description.
  - `disabled` boolean: Whether the key is disabled. Disabled keys cannot authenticate requests. Defaults to false.
  - `all_future_permissions` boolean: Grant all current and future permissions. Only callers with this authority can enable it. Defaults to false.
  - `permissions` string[], required: Complete list of current permissions to grant, for example images:create or templates:read. Ignored when all_future_permissions is true; supply an empty array in that case. Otherwise, an empty array grants no product permissions. Permissions cannot exceed the caller's authority.

## Response `200`

OK

- ApiKey: An API key's identifiers, metadata, and permissions. Does not include the secret key.
  - `id` string, required: ID used to retrieve, update, or delete this API key.
  - `api_id` string, required: API ID used as the username when authenticating API requests.
  - `name` string, required: Display name for the key.
  - `description` string, nullable: Description of the key's purpose, if provided.
  - `enabled` boolean: Whether the key is enabled.
  - `all_future_permissions` boolean: Whether the key automatically receives all current and future permissions.
  - `permissions` string[], required
  - `created_at` string, date-time: When the key was created, in UTC.
  - `updated_at` string, date-time: When the key was last updated, in UTC.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `429`: Too Many Requests

## Changes

- **2026-10-30** `146fbf859b2d`: 3 warning, 3 info
  - added the new `webhooks:create_update` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `webhooks:delete` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `webhooks:read` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `webhooks:create_update` enum value to the request property `permissions/items/`
  - …2 more
- **2026-10-14** `b686893a3e5f`: 2 warning, 2 info
  - added the new `debugs:create` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `debugs:read` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `debugs:create` enum value to the request property `permissions/items/`
  - added the new `debugs:read` enum value to the request property `permissions/items/`
- **2026-09-14** `d5730c2a58f6`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/htmlcsstoimage/apis/html-css-to-image-api/changes/v1/api-keys/:id/post.md)

---

[API](https://skmtc.dev/htmlcsstoimage/apis/html-css-to-image-api.md) - [All operations](https://skmtc.dev/htmlcsstoimage/apis/html-css-to-image-api/llms.txt) - [OpenAPI document](https://skmtc.dev/htmlcsstoimage/apis/html-css-to-image-api/revisions/100550373ae1?raw)