View and edit an API key

info

Ory Talos Secure API Keys on Ory Network is in preview. The HTTP API is versioned v2alpha1, and request and response shapes can change. Pin the version of the Ory SDK that you use.

View the details of an API key in Ory Talos Secure API Keys, and change its name, scopes, rate limit, IP restrictions, or metadata.

Before you begin

• To manage keys in the Ory Console, you need the Owner or Developer role in the project. Members with the Viewer role can't view keys or send requests from the Playground.
• If an API key page in the Ory Console shows Enable Ory Talos, select Enable API keys. The change takes a short time to apply. See Eventual consistency.

To call the API, you need your project slug and a project API key.

A project API key is required for all administrative operations. To create one, read Creating API Keys.

The quickstart shows where to find the project slug and how to set up the TypeScript and Go SDKs. The examples on this page read both values from environment variables:

export PROJECT_SLUG=<your-project-slug>
export ORY_API_KEY=<your-project-api-key>

View and edit a key

Ory Console

1. Go to API Keys → Keys in the Ory Console. The table shows the Name, Status, Created, and Expires date of each key.

2. Select the name of the key, or open the row menu of the key and select View details.

   

3. Change the fields that you need, and select Save changes. Each section has a Save changes button, and each one saves all changed fields on the page.

The top of the key detail page shows the Status, Visibility, Created, and Expires values of the key. The Overview section shows the Key ID, the Actor ID, and Last used. For a revoked key, it also shows the Revocation reason.

You can edit these fields:

• Name, in the Overview section.
• Scopes, the rate limit, and IP restrictions, in the Permissions and scopes section.
• Metadata, in the Metadata section.

curl

Send PATCH /v2alpha1/admin/issuedApiKeys/{key_id} with the new values in the body, and name the fields to change in the update_mask query parameter. You can update name, scopes, metadata, rate_limit_policy, and ip_restriction. To clear a field, list it in update_mask and leave it out of the body. For imported keys, send the same request to PATCH /v2alpha1/admin/importedApiKeys/{key_id}.

curl -sS -X PATCH "https://$PROJECT_SLUG.projects.oryapis.com/v2alpha1/admin/issuedApiKeys/$KEY_ID?update_mask=name,scopes" \
  -H "Authorization: Bearer $ORY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Billing service (read only)", "scopes": ["read:data"]}' | jq

You can't edit the actor, the expiry, or the visibility of a key. To change them, issue a new key and revoke the old one. Tokens that you derived from a key keep the scopes that they had when you derived them.

Last used

Last used shows when the key last passed verification or was used to derive a token. The value updates at most once per day (UTC), so it can lag behind the most recent use by up to a day. Verifying a token that was derived from the key doesn't update it.