---
title: "Update an API key"
method: PUT
path: "/api/token/"
---

# Update an API key

`PUT /api/token/`

Update an API key by sending its ID and editable fields in the JSON body. This endpoint behaves like a full update: send fields you want to preserve because omitted numeric, boolean, or string fields can be reset.

## Request body

- UpdateApiKeyRequest
  - `id` integer, required — Numeric API key ID returned by the list endpoint. For updates, send this value in the JSON body, not in the URL.
  - `name` string — User-readable display name for the API key. The backend accepts up to 50 Unicode characters; longer names return `success: false` with `token name is too long`.
  - `status` 1 | 2 | 3 | 4 — Operational status for the key. `1` enables the key for model requests, `2` disables it, `3` marks it expired, and `4` marks it quota exhausted. Disabled, expired, or exhausted keys are rejected by model endpoints.
  - `expired_time` integer — Unix timestamp in seconds when the key expires. Use `-1` for no expiration. A past timestamp blocks model requests with this key.
  - `remain_quota` integer — Remaining quota to assign to the key in CometAPI internal quota units. If this reaches `0` while `unlimited_quota` is `false`, model requests with this key are rejected as quota exhausted.
  - `unlimited_quota` boolean — Whether the key bypasses remaining-quota checks. Set `true` only when the key should keep working even if `remain_quota` is `0`.
  - `model_limits_enabled` boolean — Whether to restrict this key to specific models. When `true`, only model IDs listed in `model_limits` are allowed. When `false`, `model_limits` is ignored.
  - `model_limits` string — Comma-separated model IDs allowed by this key when `model_limits_enabled` is `true`. Use model IDs returned by `/v1/models`, for example `<model-id-1>,<model-id-2>`. Use an empty string for no model restriction.
  - `allow_ips` string, nullable — Optional IP allowlist. Provide one JSON string with entries separated by newline characters (`\n`). Each entry can be a single IPv4 address, single IPv6 address, IPv4 CIDR, or IPv6 CIDR. Example for three allowlist entries: `198.51.100.10\n203.0.113.0/24\n2001:db8::/32`. CometAPI compares the model request client IP to this list. Use `null` or `""` to disable IP restrictions.
  - `group` string — Optional account group restriction. Use an empty string for no explicit group restriction. Non-empty values must be available to the account, or the API returns `success: false` with a `no access to group` message.
  - `cross_group_retry` boolean — Whether cross-group retry is enabled for automatic group routing. This is only meaningful when the key uses an auto-routed group such as `auto`.

## Response `200`

Updated API key record.

- object
  - `success` boolean, required
  - `message` string, required
  - `data` ApiKey, required
    - `id` integer — Numeric API key ID. Use this value with the get, update, and delete endpoints.
    - `user_id` integer — Account user ID that owns the key.
    - `key` string — API key value returned by the management API. Treat it as a secret and use it as `Authorization: Bearer $COMETAPI_KEY` for model requests.
    - `status` 1 | 2 | 3 | 4 — Operational status for the key. `1` means enabled, `2` disabled, `3` expired, and `4` exhausted. Only enabled keys are accepted by model endpoints.
    - `name` string — User-readable display name for the API key.
    - `created_time` integer — Unix timestamp in seconds when the key was created.
    - `accessed_time` integer — Unix timestamp in seconds when the key was last used. Newly created keys may show the creation time until first use.
    - `expired_time` integer — Unix timestamp in seconds when the key expires. `-1` means no expiration.
    - `remain_quota` integer — Remaining quota for this key in CometAPI internal quota units. When this reaches `0` and `unlimited_quota` is `false`, model requests are rejected as quota exhausted.
    - `unlimited_quota` boolean — Whether the key bypasses remaining-quota checks.
    - `model_limits_enabled` boolean — Whether model restrictions are active for this key. When `false`, `model_limits` is ignored.
    - `model_limits` string — Comma-separated model IDs allowed by this key when `model_limits_enabled` is `true`. Empty means no configured model list.
    - `allow_ips` string, nullable — Optional IP allowlist stored as one newline-separated string. Each entry can be a single IPv4 address, single IPv6 address, IPv4 CIDR, or IPv6 CIDR. Example: `198.51.100.10\n203.0.113.0/24\n2001:db8::/32`. `null` or `""` means IP restrictions are disabled.
    - `used_quota` integer — Quota already consumed by this key in CometAPI internal quota units.
    - `group` string — Account group restriction for this key. Empty means no explicit group restriction.
    - `cross_group_retry` boolean — Whether cross-group retry is enabled for automatic group routing. This is only meaningful when the key uses an auto-routed group such as `auto`.

---

[API](https://skmtc.net/cometapi/apis/create-api-key.md) · [All operations](https://skmtc.net/cometapi/apis/create-api-key/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cometapi/create-api-key/versions/0863102dbf34/schema)