---
title: "Update API key"
method: PATCH
path: "/api/v1/api-keys/{id}"
tags: ["API Keys"]
---

# Update API key

`PATCH /api/v1/api-keys/{id}`

## Request

- Base URL: `https://xquik.com`
- URL: `https://xquik.com/api/v1/api-keys/{id}`
- Auth: API key in cookie `__Host-xquik_session`

Renames an active API key, changes its scopes, IP allowlist or monthly credit budget, or pauses or resumes it. Send any of name, scope, scopes, paused, allowedIps & monthlyBudgetCredits. Pausing again keeps the first pause time. Pausing or resuming a revoked or expired key answers 409.

## Path parameters

- `id` string, required

## Request body

- object
  - `name` string: Up to 100 characters. An empty name saves the key as Default.
  - `scope` 'full' | 'paid_reads': The scope to save. The key's next request uses it.
  - `scopes` string[]: full calls every route. read calls paid X reads. write, monitors, exports & billing add their routes. scopes wins over scope. Missing keeps the key's scopes.
  - `allowedIps` string[]: Up to 20 IPv4 or IPv6 addresses or CIDR ranges. The list replaces the saved one, & an empty list allows any IP.
  - `monthlyBudgetCredits` integer, nullable: Credits the key can spend each UTC calendar month. Null removes the budget, & a missing field keeps it.
  - `paused` boolean: true pauses the key, so its calls get 403 `api_key_paused`. false resumes it, & its next call goes through.

## Response `200`

API key updated

- ApiKey: API key metadata returned when listing keys.
  - `id` string, required
  - `name` string, required
  - `prefix` string, required
  - `scope` 'full' | 'paid_reads', required: full calls every route an API key can use. paid_reads calls paid X reads plus the routes of its scopes. Other routes answer it with 403.
  - `scopes` string[], required: The scopes the key holds, such as read & monitors. A Full access key holds full.
  - `allowedIps` string[], required: The IPs & CIDR ranges the key accepts calls from. An empty list accepts any IP. The API returns each range with host bits cleared, IPv6 in short form and IPv4-mapped IPv6 as IPv4.
  - `isActive` boolean, required
  - `createdAt` string, date-time, required
  - `expiresAt` string, date-time: When the key stops working. Missing when it never expires.
  - `lastUsedAt` string, date-time: When the key last made a request. Missing until it does.
  - `monthlyBudgetCredits` integer: Credits the key can spend each UTC calendar month. Missing when the key has no budget. A call that doesn't fit what's left gets 403 `api_key_budget_reached` & costs nothing. A refused call never runs. A read with a `limit` needs that many results' price left, & a media download needs the price of every post it names. A read without a `limit`, an extraction, a draw & a style refresh return only what fits. A write needs its price plus 20 credits left, & it charges only what it uses. Calls running at once can't take the key past its budget. A started call bills what it delivered, even past a lowered budget.
  - `monthlySpentCredits` integer, required: Credits charged for calls with the key this UTC calendar month. Once it reaches the budget, every call with the key gets 403 `api_key_budget_reached` until the next UTC month or a higher budget, even a retry with a used Idempotency-Key.
  - `pausedAt` string, date-time: When the key was paused. Missing while it works. A paused key gets 403 `api_key_paused` on every call.

## Other responses

- `400`: Invalid input. A value past its maxLength gets this answer, & the message names the field & its limit. Bad input costs nothing, since it's refused before any read.
- `401`: Unauthenticated
- `403`: An API key or OAuth token called a route that needs a dashboard session. Sign in at dashboard.xquik.com/account instead.
- `404`: Not found
- `409`: The key is revoked or expired, so it can't be paused or resumed. Create a new key instead.
- `429`: Too many requests right now. Each user gets 500 reads a second. Each minute allows 120 writes & 60 deletes. `x_api_rate_limited` means X limits this read for now. Neither answer costs anything. Wait for the seconds in `Retry-After`, then retry.
- `500`: Unexpected error.
- `default`: Unexpected error.

## Changes

- **2026-10-31** `2e8e935f1661`: 1 info
  - endpoint added
- **2026-10-31** `c57c57352955`: 1 breaking
  - api path removed without deprecation
- **2026-10-30** `02f0b86fb58d`: 1 breaking
  - api path removed without deprecation
- **2026-10-30** `d7a994ca1067`: 1 info
  - endpoint added
- **2026-10-30** `722bcc0a4fec`: 1 breaking
  - api path removed without deprecation

[Operation history](https://skmtc.dev/xquik-dev/apis/xquik-api/changes/api/v1/api-keys/:id/patch.md)

---

[API](https://skmtc.dev/xquik-dev/apis/xquik-api.md) - [All operations](https://skmtc.dev/xquik-dev/apis/xquik-api/llms.txt) - [OpenAPI document](https://skmtc.dev/xquik-dev/apis/xquik-api/revisions/2e8e935f1661?raw)