Skip to main content
You need a root key with the permissions listed on this page. Create one in the dashboard under Settings > Root Keys, and pass it as Authorization: Bearer <root key>. See Permission reference for every permission.
Replace all direct permissions on a key in one step. Permissions not in the list are removed, and roles are untouched. Changes can take up to about 10 seconds to apply. Calls POST /v2/keys.setPermissions. See Managing key permissions.

​
Usage

​
Flags

​
string
required
Id of the key.
​
string[]
required
Comma-separated permission slugs that become the key’s full set of direct permissions. A slug that doesn’t exist yet is created.

​
Shared flags

Every unkey api command takes these. See CLI output and shared flags.
​
string
Root key used for the request. Falls back to UNKEY_ROOT_KEY, then to the key stored by unkey auth login.
​
string
default:"https://api.unkey.com"
Base URL of the API. Falls back to UNKEY_API_BASE_URL. You don’t normally need to set it.
​
string
default:"~/.unkey/config.toml"
Path of the config file written by unkey auth login. Falls back to UNKEY_CONFIG.
​
string
Output format. Falls back to UNKEY_OUTPUT. json prints the full response. Any other value prints the request ID and data.
​
string
Send this JSON as the whole request body instead of using the command’s flags. You can’t combine it with them.

​
Required permissions

api.*.update_key or api.<apiId>.update_key together with rbac.*.add_permission_to_key and rbac.*.remove_permission_from_key. Creating a new slug also needs rbac.*.create_permission. See Root key permissions.

​
Examples

Set the exact permissions
Or send the whole request as JSON:
Raw body
Last modified on September 29, 2026