Change what an API key can do, without replacing it
Your API keys and OAuth clients can now be edited. Add a permission you didn't ask for at the start, or take one away, and the key itself stays exactly the same — so there's nothing to redeploy.
Outgrown the permissions you picked when you created an API key? Edit it. The key doesn't change, so nothing on your side has to.
What's new
- Edit any live key or client — go to Developers, and use the pencil next to a key or OAuth client. You can rename it, tick a permission you now need, or untick one you don't.
- The secret stays the same — this is the point of it. Previously the only way to widen a key's permissions was to create a new key and update every server, script and integration using the old one. Now it's a one-minute edit and your existing key keeps working.
- Taking permissions away is just as quick — useful if a key turns out to be allowed to do more than it should. The change applies to the very next call.
- Three permissions that were missing are now listed — reading and adding internal conversation comments, and the Graph API proxy writes, can now be ticked like any other.
- For OAuth clients, a small timing note — your new permissions apply to access tokens issued from the moment you save. A token already issued keeps the permissions it was created with until it expires, within the hour.
- Revoked keys stay revoked — a key you've revoked can't be edited back to life. Create a new one instead.
Editing is available to owners and admins, and every change is recorded in your audit trail with exactly which permissions were added or removed.