---
title: "Create App Secret"
method: POST
path: "/v1/apps/{app_id}/secrets"
tags: ["apps"]
---

# Create App Secret

`POST /v1/apps/{app_id}/secrets`

## Request

- Base URL: `https://api.shapemaker.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.shapemaker.io/v1/apps/{app_id}/secrets`
- Auth: OAuth 2
  - Password
  - Token URL: `/v1/auth`

## Path parameters

- `app_id` integer, required

## Request body

- AppSecretCreateInput
  - `description` string
  - `expiresInDays` integer, nullable

## Response `200`

Successful Response

- AppSecretIssuedView: The one response that carries a plaintext secret. The server keeps only its hash, so the secret cannot be read again after this.
  - `clientId` string, uuid4, required
  - `clientSecret` string, required
  - `expiresAtUTC` string, date-time, nullable, required
  - `message` string

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/shapemaker/apis/shapemaker-api.md) - [All operations](https://skmtc.dev/shapemaker/apis/shapemaker-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shapemaker/apis/shapemaker-api/revisions/b8461cf1236c?raw)