---
title: "axiom app-key update"
description: "Re-point an app key at new flows and/or browser origins (the key value is unchanged)"
category: reference
surfaces: [cli]
related: [reference/cli/axiom-app-key]
last_reviewed: 2026-06-06
---

<!-- GENERATED by docs/scripts/gen-cli-reference — DO NOT EDIT.
     Source of truth: the cobra command definitions in cmd/axiom/cmd/.
     Regenerate from the repo root with: go run ./docs/scripts/gen-cli-reference -->

# axiom app-key update

Re-point an app key at new flows and/or browser origins (the key value is unchanged)

Replace the flows (graph IDs) and/or the browser origins an app key allows,
without re-minting it.

The key VALUE does not change — the axapp_… string already embedded in your
app's bundle keeps working, now against what you list here. This is the verb to
use after a recompile mints a new graph ID, or after your app moves to a new
origin.

```text
axiom app-key update <key-id> --graph 01JNEWGRAPHID...
axiom app-key update <key-id> --origin https://myapp.example.com
axiom app-key update <key-id> --graph 01JNEW... --origin https://myapp.example.com
```

Each flag is a full REPLACEMENT of its list, not an addition: any graph or
origin you do not list stops being allowed. A flag you omit leaves that list
untouched. --clear-origins removes the origin restriction entirely (the API
spelling is "allowed_origins": []), which lets any browser origin call the key
— CORS stops being an obstacle, and only the graph allowlist, the rate caps and
your in-flow authorization restrict it.

Scopes, rate caps and expiry are fixed at mint and cannot be patched.

--if-generation guards the patch against a concurrent update (two publishes
racing on the same key): pass the "generation" a prior create/update/ls
returned, and this update is refused with the key's CURRENT state if someone
else patched it first, instead of silently overwriting their change. Omit it
for the old behaviour — a blind replace, last writer wins.

## Usage

```sh
axiom app-key update <key-id> [flags]
```

## Flags

| Flag | Shorthand | Type | Default | Description |
|---|---|---|---|---|
| `--clear-origins` |  | bool |  | Remove the origin restriction entirely (any browser origin may then call this key) |
| `--graph` |  | stringArray | `[]` | Graph ID the key may invoke — the full replacement allowlist (repeatable; omit to leave the flows unchanged) |
| `--help` | `-h` | bool |  | help for update |
| `--if-generation` |  | int | `0` | Guard the patch with a compare-and-swap: only apply if the key is still at this generation (from a prior create/update/ls --json); omit for the legacy blind replace |
| `--json` |  | bool |  | Emit the updated key as JSON |
| `--origin` |  | stringArray | `[]` | Browser origin to allowlist — the full replacement list (repeatable; omit to leave the origins unchanged) |

## See also

- [axiom app-key](./axiom-app-key.md) — Manage invoke-scoped app keys (public browser credentials)