> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xquik.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update an Xquik API key's name or scope in place

> Rename an active Xquik API key or change its scope between full access and paid reads only. It keeps its secret & expiry, and its next request uses the change.

**200**

```json theme={null}
{
  "id": "42",
  "name": "Analytics notebook",
  "prefix": "xq_live_exam",
  "scope": "paid_reads",
  "isActive": true,
  "createdAt": "2025-01-15T12:00:00Z"
}
```

**400**

```json theme={null}
{
  "error": "invalid_input",
  "message": "Invalid input. Check the request body."
}
```

**401**

```json theme={null}
{
  "error": "unauthenticated",
  "message": "Authentication required. Provide a valid API key or bearer token."
}
```

**403**

```json theme={null}
{
  "error": "session_required",
  "message": "API keys & OAuth tokens cannot use this route. Sign in at dashboard.xquik.com/account instead."
}
```

**404**

```json theme={null}
{
  "error": "not_found",
  "message": "Resource not found."
}
```

**429**

```json theme={null}
{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Try again later.",
  "retryAfter": 60
}
```

> For the complete documentation index, see [llms.txt](/llms.txt).

Rename a key so its owner is clear, or narrow a key that only reads to `paid_reads`. Send `name`,
`scope`, or both. The key keeps its secret, prefix and expiry.

**Free.** This endpoint does not consume credits.

```bash cURL theme={null}
curl -X PATCH https://dashboard.xquik.com/api/v1/api-keys/42 \
  -H "Cookie: __Host-xquik_session=YOUR_SESSION_COOKIE" \
  -H "Origin: https://dashboard.xquik.com" \
  -H "Sec-Fetch-Site: same-origin" \
  -H "Content-Type: application/json" \
  -d '{"name": "Analytics notebook", "scope": "paid_reads"}' | jq
```

```javascript Node.js theme={null}
const response = await fetch("https://dashboard.xquik.com/api/v1/api-keys/42", {
  method: "PATCH",
  headers: {
    Cookie: "__Host-xquik_session=YOUR_SESSION_COOKIE",
    Origin: "https://dashboard.xquik.com",
    "Sec-Fetch-Site": "same-origin",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ name: "Analytics notebook", scope: "paid_reads" }),
});
const key = await response.json();
console.log(key);
```

```python Python theme={null}
import requests

response = requests.patch(
    "https://dashboard.xquik.com/api/v1/api-keys/42",
    cookies={"__Host-xquik_session": "YOUR_SESSION_COOKIE"},
    headers={"Origin": "https://dashboard.xquik.com", "Sec-Fetch-Site": "same-origin"},
    json={"name": "Analytics notebook", "scope": "paid_reads"},
)
key = response.json()
print(key)
```

```go Go theme={null}
package main

import (
	"bytes"
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	body := bytes.NewBufferString(`{"name": "Analytics notebook", "scope": "paid_reads"}`)
	req, err := http.NewRequest("PATCH", "https://dashboard.xquik.com/api/v1/api-keys/42", body)
	if err != nil {
		log.Fatal(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Origin", "https://dashboard.xquik.com")
	req.Header.Set("Sec-Fetch-Site", "same-origin")
	req.AddCookie(&http.Cookie{Name: "__Host-xquik_session", Value: "YOUR_SESSION_COOKIE"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	answer, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(string(answer))
}
```

## Path parameters

**id** `string` *required*

The unique identifier of the API key to update.

## Headers

**Cookie** `string` *required*

Your signed-in dashboard session cookie, `__Host-xquik_session`. API keys and OAuth tokens get
`403 session_required`.

**Origin** `string` *required*

Must be `https://dashboard.xquik.com`, sent with `Sec-Fetch-Site` set to `same-origin`. The
dashboard sends both.

**Content-Type** `string` *required*

Must be `application/json`.

## Body

Send at least 1 field.

**name** `string`

New display name, up to 100 characters. An empty name saves `"Default"`.

**scope** `string`

`full` calls every route an API key can use. `paid_reads` calls paid X read routes only. Other
routes answer it with `403 forbidden`. The key's next request uses the new scope.

## Response

### 200 OK

Returns the saved key with the same fields as [List API keys](/api-reference/api-keys/list.md).

```json theme={null}
{
  "id": "42",
  "name": "Analytics notebook",
  "prefix": "xq_a1b2",
  "scope": "paid_reads",
  "isActive": true,
  "createdAt": "2026-02-24T10:30:00.000Z",
  "lastUsedAt": "2026-02-24T18:45:12.000Z"
}
```

### 400 Invalid input

```json theme={null}
{
  "error": "invalid_input",
  "message": "Send name or scope to change."
}
```

The body had neither field, `scope` was not `full` or `paid_reads`, or `name` was longer than 100
characters. Xquik changes nothing.

### 401 Unauthenticated

```json theme={null}
{ "error": "unauthenticated" }
```

Missing, expired, or invalid dashboard session cookie.

### 404 Not found

```json theme={null}
{ "error": "not_found" }
```

No active API key with this ID exists on your account. A revoked key cannot change.

### 429 Rate limited

```json theme={null}
{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Try again later.",
  "retryAfter": 60
}
```

Too many requests. Wait for the `Retry-After` header before retrying.

> [!NOTE]
>
> API key changes require a same-origin dashboard session. API keys and OAuth bearer tokens cannot
> change account keys.
>
> **Related.** [Create API Key](/api-reference/api-keys/create.md) · [List API Keys](/api-reference/api-keys/list.md) · [Revoke API Key](/api-reference/api-keys/revoke.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.