---
title: "Change a public chat token"
method: PATCH
path: "/chat-tokens/{id}"
tags: ["Chat widget"]
---

# Change a public chat token

`PATCH /chat-tokens/{id}`

## Request

- Base URL: `https://api.hypamoon.com/api/v1`
- URL: `https://api.hypamoon.com/api/v1/chat-tokens/{id}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.hypamoon.com/oauth/authorize`, token URL `https://api.hypamoon.com/oauth/token`, scopes: `chat:write`)

Changes the name, the display name (the business name in the chat window and its greeting), the allowed origins, the bot check or the daily limit of a token. Fields you leave out stay as they are; allowed_origins replaces the whole list. The token itself stays the same, so the snippet on the website keeps working. A revoked token cannot be changed (409 chat_token_revoked): create a new one.

## Path parameters

- `id` string, uuid, required

## Request body

- ChatTokenUpdate: Change a public chat token. Fields you leave out stay as they are.
  - `name` string
  - `display_name` string, nullable: The name the assistant uses for the business in the chat window, like "Knip": in the greeting ("You are chatting with the digital assistant of Knip.") and in its answers. null or an empty string goes back to the name of the site the widget is on, and otherwise the project name.
  - `allowed_origins` string[]
  - `turnstile` boolean
  - `max_conversations_per_day` integer

## Response `200`

The token as changed.

- ChatToken: A public chat token for the chat widget on a website.
  - `id` string, uuid, required: The id of the public chat token. Use it to change or revoke the token.
  - `name` string, required: Your name for the token, like the website it is for.
  - `display_name` string, nullable, required: The name the assistant uses for the business in the chat window and its greeting, or null: then the name of the site the widget is on, and otherwise the project name.
  - `token` string, required: The public chat token: hm_pub_ (live) or hm_pubtest_ (test project) plus 24 characters. Not a secret: it goes in the page source of your website.
  - `mode` 'live' | 'test', required: live or test, from the project the key belongs to.
  - `allowed_origins` string[], required: The exact origins that may use the token, like https://www.example.com. A test token also works from localhost.
  - `turnstile` boolean, required: Whether a visitor passes a bot check before a conversation starts.
  - `max_conversations_per_day` integer, required: New conversations per day through this token, counted until midnight, Europe/Amsterdam.
  - `revoked` boolean, required: true once the token is revoked: the widget stops working right away, also in open conversations.
  - `revoked_at` string, date-time, nullable, required: When the token was revoked.
  - `last_used_at` string, date-time, nullable, required: When a browser last used the token, to the minute.
  - `created_at` string, date-time, required: When the token was created.
  - `embed_code` string, required: The script tag for your website, with this token in it. Paste it before </body>.
  - `kind` 'chat' | 'form', required: chat: the chat widget, the cart, the checkout and forms. form: only forms that post to a collection with public_write (made by Hypamoon for a form on a site); it cannot chat.
  - `warnings` object[]: Only in the answer of POST /chat-tokens, and only when there is something to tell. The token is created either way.
    - `code` 'assistant_not_set', required: The project has no assistant yet, so the widget cannot answer visitors.
    - `message` string, required: What this means, in plain words.
    - `next_step` string, required: What to do next, with the tool or route to use.

## Other responses

- `400`: Bad Request: invalid_json.
- `401`: Unauthorized: unauthorized, missing_api_key, invalid_api_key, api_key_revoked, project_deleted.
- `403`: Forbidden: project_not_enabled, key_mode_mismatch, missing_scope, verification_required.
- `404`: Not Found: not_found.
- `409`: Conflict: chat_token_revoked.
- `422`: Unprocessable Content: validation_failed.
- `429`: Too Many Requests: rate_limited.
- `500`: Internal Server Error: internal_error.
- `503`: Service Unavailable: service_unavailable.

---

[API](https://skmtc.dev/hypamoon/apis/hypamoon-api.md) · [All operations](https://skmtc.dev/hypamoon/apis/hypamoon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hypamoon/apis/hypamoon-api/revisions/9f0b90004c06?raw)