---
title: "Update a web tracking key"
method: PATCH
path: "/web-tracking-keys/{id}"
tags: ["Web Tracking Keys"]
---

# Update a web tracking key

`PATCH /web-tracking-keys/{id}`

Renames a key, replaces its allowed origins, or revokes it. allowedOrigins replaces the whole list rather than appending. Revoking stops events within about a minute while preserving the key value, so the matching snippet can still be found and removed from the site. Requires the integrations:manage scope.

## Path parameters

- `id` string, required

## Request body

- object
  - `name` string
  - `allowedOrigins` string[] — Replacement allowlist. Pass an empty array to make the key unrestricted.
  - `isActive` boolean — Set false to revoke the key, true to re-enable a revoked one.

## Response `200`

Key updated

- object
  - `success` boolean
  - `key` WebTrackingKey — A publishable key for the browser tracking SDK. The key ships in the customer's page source by design, so it is not a secret; it authorizes storefront customer events only and carries an origin allowlist instead of scopes.
    - `id` string
    - `name` string
    - `publicKey` string — The publishable key, prefixed seq_pk_.
    - `allowedOrigins` string[] — Normalized origins allowed to use this key. Empty means any origin.
    - `isActive` boolean — False when revoked. Revoked keys are rejected at ingest.
    - `unrestricted` boolean — True when the allowlist is empty, so any site can send events with this key.
    - `lastUsedAt` string, date-time, nullable — When the key last authorized an event, or null if it never has. Updated at most every five minutes.
    - `createdAt` string, date-time
    - `updatedAt` string, date-time
    - `installSnippet` string — The exact script tag to paste into every page. Embeds both the key and the workspace id.
    - `endpoint` string — Ingest URL the SDK posts events to.
    - `warning` string — Present only when the key is unrestricted.

## Other responses

- `400` — An allowedOrigins entry is not a valid origin
- `401` — Unauthorized
- `403` — API key is missing the integrations:manage scope
- `404` — Web tracking key not found

---

[API](https://skmtc.net/sequenzy/apis/sequenzy-api.md) · [All operations](https://skmtc.net/sequenzy/apis/sequenzy-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sequenzy/sequenzy-api/revisions/8fbabe82a04d/schema)