---
title: "Get the secrets public key"
method: GET
path: "/api/secrets/public-key"
---

# Get the secrets public key

`GET /api/secrets/public-key`

## Request

- Base URL: `https://api.hyperbrowser.ai`
- URL: `https://api.hyperbrowser.ai/api/secrets/public-key`
- Auth: none declared
- TypeScript: <https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/docs/api/secrets/public-key/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the RSA public key that you encrypt secret values to before uploading them with POST /api/secrets/{id}/versions. Doesn't require authentication. Don't cache the key: after a key rotation, uploads encrypted to the old key return 409 SECRET_KEY_OUTDATED, and you fetch the key again.

## Response `200`

Success

- SecretsPublicKey
  - `kid` string, required: Key ID: the RFC 7638 SHA-256 thumbprint of the key. Put it in the `kid` header of your envelopes.
  - `alg` 'RSA-OAEP-256', required
  - `enc` 'A256GCM', required
  - `jwk` object, required: The RSA public key (at least 3072 bits) as a JWK.
    - `kty` 'RSA', required
    - `n` string, required
    - `e` string, required
    - `kid` string, required
    - `alg` 'RSA-OAEP-256', required
    - `use` 'enc', required

## Other responses

- `503`: SECRETS_NOT_CONFIGURED: secrets aren't available on this deployment.

## Changes

- **2026-10-15** `6ca0b00ee564`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/changes/api/secrets/public-key/get.md)

---

[API](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api.md) - [All operations](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/revisions/ef089024c533?raw)