---
title: Update an API key
description: Edits name, role, or storage bucket access.
doc_version: 0.1.0-preview
last_updated: 2026-09-14
---

# Update an API key

`PATCH /v1/workspaces/{workspaceId}/api-keys/{keyId}`

Edits name, role, or storage bucket access. Does not replace the secret. Cannot change kind.

## Authentication

Send `Authorization: Bearer <SPARK_API_KEY>`. Read the key from the
SPARK_API_KEY environment variable. Never print it.

## Path parameters

- `workspaceId` (string) — The workspace id.
- `keyId` (string) — The API key id.

## Request body

- `name` (string (optional)) — Display name.
- `role` (string (optional)) — New role. Cannot exceed the owner or caller. Cannot change kind. One of: viewer, editor, admin.
- `bucketScope` (object (optional)) — Storage keys only. Replaces the complete bucket list.

## Example request

```bash
curl --request PATCH \
  --url "https://api.beta.graphon.ai/v1/workspaces/wspQ7WsH2Np5L/api-keys/keyE5f6G7h8I9" \
  --header "Authorization: Bearer $SPARK_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"name":"Local CLI","role":"editor"}'
```

## Example response

```json
{
  "id": "keyE5f6G7h8I9",
  "workspaceId": "wspQ7WsH2Np5L",
  "name": "Local CLI",
  "accessKeyId": "GSK0123456789ABCDE",
  "ownerKind": "user",
  "ownerId": "usrB2c3D4e5F6",
  "role": "viewer",
  "kind": "workspace",
  "bucketScope": {
    "mode": "all"
  },
  "createdAt": "2026-09-14T18:00:00.000Z",
  "lastUsedAt": null,
  "expiresAt": null,
  "revokedAt": null,
  "revision": 1
}
```

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.