---
title: "Get app secrets"
method: GET
path: "/api/apps/{handle}/{appId}/secrets"
---

# Get app secrets

`GET /api/apps/{handle}/{appId}/secrets`

## Request

- Base URL: `https://reduck.ai`
- URL: `https://reduck.ai/api/apps/{handle}/{appId}/secrets`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

List an app's secrets by name. Values are write-only: no endpoint ever gives one back.

## Path parameters

- `handle` string, required: The owner a resource is addressed under: "@username" for a personal scope, or a bare slug for a project.
- `appId` string, uuid, required

## Response `200`

OK

- AppSecrets
  - `secrets` AppSecret[], required
    - `name` string, required
    - `required` boolean, required: Whether the image's manifest says the app needs this one. False for a name the manifest never declared: nothing in the app asks for it, so nothing breaks without it.
    - `pageUsable` boolean, required: Whether a request triggered from the app's page may spend this secret. A task, the app's own server-side code, may spend every one of them regardless.

## Other responses

- `401`: Not authenticated
- `403`: Forbidden
- `404`: Not found

---

[API](https://skmtc.dev/reduck/apis/reduck-api.md) · [All operations](https://skmtc.dev/reduck/apis/reduck-api/llms.txt) · [OpenAPI document](https://skmtc.dev/reduck/apis/reduck-api/revisions/a573b91206d6?raw)