---
title: "Read a secret once, destroying it (free)"
method: GET
path: "/v1/secret/{token}"
---

# Read a secret once, destroying it (free)

`GET /v1/secret/{token}`

## Request

- Base URL: `https://soren.com`
- URL: `https://soren.com/v1/secret/{token}`
- Auth: none declared

Returns the stored secret and deletes it before responding. Free — the reader needs no wallet. Ciphertext by default; pass key=<hex> to have Soren decrypt server-side (convenient, but then Soren sees the key). Already-read, expired and never-existed are deliberately indistinguishable.

## Path parameters

- `token` string, required

## Query parameters

- `key` string

## Response `200`

The secret. It is now destroyed.

- object
  - `secret` string
  - `read_at` string
  - `destroyed` boolean

## Other responses

- `400`: Malformed token.
- `404`: Already read, expired, or never existed.

---

[API](https://skmtc.dev/soren/apis/soren-free-games-api.md) · [All operations](https://skmtc.dev/soren/apis/soren-free-games-api/llms.txt) · [OpenAPI document](https://skmtc.dev/soren/apis/soren-free-games-api/revisions/00402cfcf30d?raw)