---
title: "Update API Key"
method: PATCH
path: "/api_keys/{id}"
tags: ["API Keys"]
---

# Update API Key

`PATCH /api_keys/{id}`

Updates an API key's name, permissions, API version, expiration, or IP allowlist. Fields that are omitted keep their current value; default keys cannot be modified.

## Request body

- object
  - `api_version_date` '2025-01-01' | '2026-06-08' | '2026-06-09' | '2026-06-20' | '2026-07-01' | '2026-07-08' | '2026-07-08-1' | '2026-07-18' | '2026-07-20' | '2026-07-22' | '2026-07-23' | '2026-07-25' | '2026-07-26' | '2026-07-27' | '2026-07-29' | '2026-07-29-1' | '2026-07-31' | '2026-08-03' | '2026-08-05' | '2026-08-05-1' — Dated API version used when requests authenticated with this key omit the `Api-Version-Date` header. New keys default to the latest version.
  - `expires_at` string, nullable — When the API key should stop working, as an ISO 8601 timestamp. Omit (or pass `null` on update) for a key that never expires.
  - `ip_allowlist` string[], nullable — IPv4/IPv6 CIDR ranges allowed to use this key, for example `["203.0.113.0/24"]`. Empty or `null` allows any IP.
  - `name` string, nullable — A new human-readable name for the API key.
  - `permissions` object — The permissions policy for the API key: explicit permission statements, or a system role to inherit from. Statements without a `resources` array default to the owning account (Account API keys) or every key-addressable resource (App API keys).
    - `statements` object[] — Explicit permission statements. Required unless `system_role` is set.
      - `actions` string[], required — Permission actions covered by this statement, for example `company:basic:read`.
      - `grant` boolean, required — Whether the actions are granted (`true`) or denied (`false`).
      - `resources` string[] — Resource identifiers the statement applies to, for example `biz_xxx` or `biz_xxx|pass_*`. Defaults to the key's owning resource when omitted.
    - `system_role` 'owner' | 'admin' | 'moderator' | 'sales_manager' | 'advertiser' | 'null', nullable — A system role to inherit permissions from. Only Account API keys can use a system role.

## Response `200`

api key updated

- ApiKey
  - `api_version_date` '2025-01-01' | '2026-06-08' | '2026-06-09' | '2026-06-20' | '2026-07-01' | '2026-07-08' | '2026-07-08-1' | '2026-07-18' | '2026-07-20' | '2026-07-22' | '2026-07-23' | '2026-07-25' | '2026-07-26' | '2026-07-27' | '2026-07-29' | '2026-07-29-1' | '2026-07-31' | '2026-08-03' | '2026-08-05' | '2026-08-05-1', required — Dated API version used when requests authenticated with this key omit the `Api-Version-Date` header.
  - `created_at` string, required — When the API key was created, as an ISO 8601 timestamp.
  - `expires_at` string, nullable, required — When the API key stops working, as an ISO 8601 timestamp. `null` means it never expires.
  - `grants` ApiKeyGrant[]
    - `actions` ApiKeyGrantAction[], required
      - `action` string, required — The permission action's identifier, for example `company:basic:read`.
      - `granted` boolean, required — Whether the key holds the action on the grant's resource.
    - `resource_id` string, required — ID of the resource the actions apply to.
    - `resource_type` string, required — The type of resource the actions apply to, such as `account`, `product`, or `app`.
  - `id` string, required — API key ID, prefixed `apik_`.
  - `ip_allowlist` string[], nullable, required
  - `is_default_for_resource` boolean, required — Whether this is the resource's default API key. Default keys cannot be updated or deleted, only rotated.
  - `name` string, nullable, required — Human-readable name identifying the API key, or `null` when none was set.
  - `obfuscated_secret_key` string, required — Masked version of the secret key, so the key can be recognized without revealing the full secret.
  - `secret_key` string — The full secret used to authenticate requests. Returned only once, on create and rotate responses — store it immediately.
  - `system_role` 'owner' | 'admin' | 'moderator' | 'sales_manager' | 'advertiser' | 'null', nullable, required — System role the key inherits its permissions from, or `null` when it uses an explicit permissions policy. Only account API keys can use a system role.
  - `updated_at` string, required — When the API key was last updated, as an ISO 8601 timestamp.

## Other responses

- `400` — Invalid Parameters
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Resource not found

---

[API](https://skmtc.net/whop/apis/whop-api.md) · [All operations](https://skmtc.net/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whop/whop-api/versions/db0883548bc5/schema)