---
title: "List the app secret NAMES (never values)"
method: GET
path: "/app/{id}/secrets"
---

# List the app secret NAMES (never values)

`GET /app/{id}/secrets`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/app/{id}/secrets`
- Auth: HTTP bearer

Owner-only. Returns the names of the secrets stored for this app so the owner can see what is set. Values are never returned by any endpoint — secrets are write-only from the dashboard and are only decrypted host-side when an app references one. Requires the owner's user token; app/render tokens are rejected.

## Response `200`

The secret names for this app.

- AppSecretListResponse: Owner-visible list of secret NAMES (values are never echoed).
  - `ok` true, required
  - `names` string[], required

## Other responses

- `401`: User-scoped auth required.
- `403`: Caller does not own this app, or the app is anon-owned.
- `404`: App not found.

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)