---
title: "Read the app's secret"
method: GET
path: "/clients/{id_client}/apps/{id_app}/secret"
tags: ["apps"]
---

# Read the app's secret

`GET /clients/{id_client}/apps/{id_app}/secret`

## Request

- Base URL: `https://api.planvortex.com/v1.0.0`
- URL: `https://api.planvortex.com/v1.0.0/clients/{id_client}/apps/{id_app}/secret`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (client credentials, token URL `https://api.planvortex.com/v1.0.0/oauth/token`)

Returns the `client_secret` in clear. It is a separate endpoint precisely so that the secret never travels inside a listing that gets logged, cached or drawn on a screen by accident.

The same secret is what signs the outgoing webhooks (`x-hub-signature`, `x-hub-signature-256`).

**Needs a USER token, not an app token.** With client credentials it answers `ERROR_CODE_512`. **No plan is required**: apps are on all four plans, the free one included — what the plan decides is how many you can hold at once and how fast you can call.

It comes straight from Keycloak, so it is the live secret and not a copy: treat the response as a credential and never log it.

## Path parameters

- `id_client` string, required
- `id_app` string, required

## Response `200`

The secret

- object
  - `secret` string, required

## Other responses

- `400`: Error. Classify by `code` in the body, never by the HTTP status.

---

[API](https://skmtc.dev/planvortex/apis/planvortex-api.md) · [All operations](https://skmtc.dev/planvortex/apis/planvortex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/planvortex/apis/planvortex-api/revisions/abedbbc1cd52?raw)