axiom app-key update
Re-point an app key at new flows and/or browser origins (the key value is unchanged)
View as Markdownaxiom app-key update
Re-point an app key at new flows and/or browser origins (the key value is unchanged)
Replace the flows (graph IDs) and/or the browser origins an app key allows, without re-minting it.
The key VALUE does not change — the axapp_… string already embedded in your app's bundle keeps working, now against what you list here. This is the verb to use after a recompile mints a new graph ID, or after your app moves to a new origin.
axiom app-key update <key-id> --graph 01JNEWGRAPHID...
axiom app-key update <key-id> --origin https://myapp.example.com
axiom app-key update <key-id> --graph 01JNEW... --origin https://myapp.example.comEach flag is a full REPLACEMENT of its list, not an addition: any graph or origin you do not list stops being allowed. A flag you omit leaves that list untouched. --clear-origins removes the origin restriction entirely (the API spelling is "allowed_origins": []), which lets any browser origin call the key — CORS stops being an obstacle, and only the graph allowlist, the rate caps and your in-flow authorization restrict it.
Scopes, rate caps and expiry are fixed at mint and cannot be patched.
--if-generation guards the patch against a concurrent update (two publishes racing on the same key): pass the "generation" a prior create/update/ls returned, and this update is refused with the key's CURRENT state if someone else patched it first, instead of silently overwriting their change. Omit it for the old behaviour — a blind replace, last writer wins.
Usage
axiom app-key update <key-id> [flags]Flags
| Flag | Shorthand | Type | Default | Description |
|---|---|---|---|---|
--clear-origins | bool | Remove the origin restriction entirely (any browser origin may then call this key) | ||
--graph | stringArray | [] | Graph ID the key may invoke — the full replacement allowlist (repeatable; omit to leave the flows unchanged) | |
--help | -h | bool | help for update | |
--if-generation | int | 0 | Guard the patch with a compare-and-swap: only apply if the key is still at this generation (from a prior create/update/ls --json); omit for the legacy blind replace | |
--json | bool | Emit the updated key as JSON | ||
--origin | stringArray | [] | Browser origin to allowlist — the full replacement list (repeatable; omit to leave the origins unchanged) |
See also
- axiom app-key — Manage invoke-scoped app keys (public browser credentials)