Skip to main content
GET
Get a Secret

Authorizations

Authorization
string
header
required

An API token for one organization. You create and revoke tokens in the dashboard. A token scoped to one App can reach only that App, so give that kind of token to an agent. An organization-wide token can create a short-lived one with POST /api/tokens.

Scopes

apps:read
OAuth

See the organization's Apps, with their files, deployments, and logs.

apps:read
DPoP

Path Parameters

id
string
required

A unique ID that starts with app_.

Pattern: ^app_[0-9A-Za-z]{24}$
Example:

"app_Zj7XhMgplmTJcp5Dk4vcYuk0"

name
string
required

The Secret's name: uppercase letters, digits, and underscores, not starting with a digit. The App reads the value as an environment variable with this name.

Pattern: ^[A-Z_][A-Z0-9_]{0,127}$
Example:

"STRIPE_SECRET_KEY"

Response

The Secret, without its value.

id
string
required

The Secret's ID, which starts with sec_.

app_id
string
required

The ID of the App that the Secret belongs to.

name
string
required

The Secret's name. The App reads the value as an environment variable with this name.

created_at
string<date-time>
required

When the Secret was created.

Example:

"2026-10-03T14:01:30.000Z"

updated_at
string<date-time>
required

When the Secret's name or value last changed.

Example:

"2026-10-03T14:01:30.000Z"