Get the secrets public key

Changed on

Returns the RSA public key that you encrypt secret values to before uploading them with POST /api/secrets/{id}/versions. Doesn't require authentication. Don't cache the key: after a key rotation, uploads encrypted to the old key return 409 SECRET_KEY_OUTDATED, and you fetch the key again.

get/api/secrets/public-key

Request

Response

Success

kidstring required

Key ID: the RFC 7638 SHA-256 thumbprint of the key. Put it in the kid header of your envelopes.

alg'RSA-OAEP-256' required
enc'A256GCM' required

Changes