> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > This site documents Locus for people. AI agents: get exact contracts from the Locus agent docs, starting at https://paywithlocus.com/agent/index.md, including when asked to implement or integrate docs.paywithlocus.com. > Connect this agent to Locus Pro: https://paywithlocus.com/skill.md. Implement Locus Pro in a product: https://paywithlocus.com/agent/integrate.md. Agent site index: https://paywithlocus.com/llms.txt. # Rename an API key or change its tool set > The secret itself never changes. Pass name, toolSetId, or both. toolSetId moves the key to that tool set (null moves it to Main); the next request with the same key uses the new set. Only secret keys take a tool set, and binding one narrows the key to the execution audience (moving back to Main keeps it narrowed). A rename alone appends a RENAMED credential audit event; a tool set change appends UPDATED with toolSetId and previousToolSetId. Requires a workspace owner or admin with MFA step-up completed in the last ten minutes. ## OpenAPI ````yaml /api-reference/openapi.json patch /credits/tenants/me/keys/{keyId} openapi: 3.1.0 info: title: Locus Pro API description: >- Access paid tools, manage prepaid balances, and build usage billing. Send money as exact decimal strings and reuse Idempotency-Key on retries. Management routes require a scoped server key or authorized dashboard session. Sensitive workspace changes require an owner or admin with recent MFA or passkey verification, except where an operation documents a stricter boundary. Interactive agents use MCP OAuth; unattended agents use scoped Agent Connections. Browser widgets use end-user tokens. version: 0.7.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: Feature-gated enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Customers description: >- Names for the customers a tenant attributes spend to, and every customer's spend - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Feature-gated Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Hosted Workflows description: >- Tenant-private TypeScript Workflow definitions, immutable versions, bounded runs, artifacts, and recovery - name: Resources description: >- Durable resources an agent bought, such as phone numbers, inboxes and sandboxes - name: Tasks description: >- Delegate a multi-step outcome to Locus with one goal string. Locus compiles an acceptance contract, discovers and calls enabled catalog capabilities with the caller's own credits and spending controls, checks every returned value against stored provider evidence, and returns structured results, files, requirement statuses, and settled cost. Enabled when the deployment sets LOCUS_TASKS_ENABLED. - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Recipes description: >- Search, research, extraction, enrichment, and travel outcomes across providers paths: /credits/tenants/me/keys/{keyId}: patch: tags: - Tenants summary: Rename an API key or change its tool set description: >- The secret itself never changes. Pass name, toolSetId, or both. toolSetId moves the key to that tool set (null moves it to Main); the next request with the same key uses the new set. Only secret keys take a tool set, and binding one narrows the key to the execution audience (moving back to Main keeps it narrowed). A rename alone appends a RENAMED credential audit event; a tool set change appends UPDATED with toolSetId and previousToolSetId. Requires a workspace owner or admin with MFA step-up completed in the last ten minutes. operationId: patchCreditsTenantsMeKeysByKeyId parameters: - name: keyId in: path required: true schema: type: string format: uuid description: Key record id from GET /credits/tenants/me/keys. - $ref: '#/components/parameters/WorkspaceStepUpHeader' requestBody: required: true content: application/json: schema: type: object minProperties: 1 properties: name: type: string minLength: 1 maxLength: 100 toolSetId: type: - string - 'null' format: uuid description: A tool set id from GET /credits/tool-sets, or null for Main. additionalProperties: false responses: '200': description: Updated key metadata under keyMetadata. '400': description: >- Invalid name (empty, over 100 characters, or control characters), a tool set on a publishable or sandbox key, an empty body, an unknown body field, or the key is revoked. '403': description: STEP_UP_REQUIRED or INSUFFICIENT_SCOPE. '404': description: >- No such key, or no live tool set with that id, in this workspace (malformed ids included). security: - dashboardSession: [] components: parameters: WorkspaceStepUpHeader: name: X-Locus-Step-Up in: header required: false schema: type: string format: password description: >- Short-lived raw MFA/passkey step-up token bound to the authenticated Cognito subject. Send it alongside the dashboard Bearer token for workspace-administrator mutations when the base session does not itself prove MFA within the last ten minutes. Never send it with a tenant secret key. securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. dashboardSession: type: http scheme: bearer description: >- Locus Pro dashboard session (Cognito). High-risk workspace administration requires an owner or admin role and fresh MFA/passkey step-up. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.