---
title: "Change a key's IP allow-list"
method: PATCH
path: "/api/v1/keys/{id}"
tags: ["API keys"]
---

# Change a key's IP allow-list

`PATCH /api/v1/keys/{id}`

## Request

- Base URL: `https://spoofy.social`
- URL: `https://spoofy.social/api/v1/keys/{id}`
- Auth: API key in cookie `better-auth.session_token`

Set where the key may be used from: addresses or CIDR ranges (up to 20). An empty list lets it work from anywhere again. Applies from its next request.

## Path parameters

- `id` string, required

## Request body

- object
  - `allowedIps` string[], required

## Response `200`

Updated.

- object
  - `apiKey` ApiKey
    - `id` string
    - `name` string
    - `prefix` string: First characters of the key, to tell keys apart.
    - `mode` 'live' | 'test': test: every spend answers as a dry run (the real price, checks and balance; nothing charged or sent); cancelling and pausing are refused.
    - `scopes` string[]
    - `dailyCap` string, nullable: Max USD spent per UTC day (net of refunds); null = no cap.
    - `perOrderCap` string, nullable: Max USD per order; null = no cap.
    - `platforms` string[]: Allowed platforms; empty = all.
    - `allowedIps` string[]: Addresses or CIDR ranges the key works from; empty = anywhere.
    - `lastUsedAt` string, date-time, nullable
    - `lastUsedIp` string, nullable: The address it was last used from.
    - `createdAt` string, date-time
    - `revokedAt` string, date-time, nullable

## Other responses

- `400`: The request is not valid. `error.message` says why.
- `404`: Not found on your account.
- `413`: The request body is too big (uploads up to 4 MB, everything else up to 64 KB).
- `429`: Slow down: too many requests in a short time. Wait `Retry-After` seconds and carry on.

---

[API](https://skmtc.dev/spoofy/apis/spoofy-api.md) · [All operations](https://skmtc.dev/spoofy/apis/spoofy-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spoofy/apis/spoofy-api/revisions/58adc986f826?raw)