This page View Markdown Open in ChatGPT Open in Claude

Get secret¶

Reads values of a secret by their path : common.encryptionAlgorithm, stripe.apiKey… One key gives its value, several give an array in the same order.


Method	POST
URL	`/api/system-api/admin/get-secret-by-name` : `admin` is the user path of your account
Body	`{ keys }` ; from code also `fromSecretName`
Answer	`data` : the value, or an array of values
From code	`g.sys.system.getSecret`

The call¶

Body : one key

{ "keys": "stripe.apiKey" }

Answer

{ "success": true, "statusCode": 200, "data": "sk_live_…" }

Body : several keys

{ "keys": [ "stripe.apiKey", "common.connectionString.mysql_8" ] }

Answer

{ "success": true, "statusCode": 200, "data": [ "sk_live_…", "mysql://…" ] }

keys is the full path in the secret object, with dots. A path to an object gives the object.
Over HTTP the default secret of the account answers. From code, fromSecretName reads another secret of the account by its name ; over HTTP that key is ignored.

From code¶

TypeScriptPythonPHPC#GoRustJavaKotlin

const key = await g.sys.system.getSecret('stripe.apiKey');
const [ key2, cs ] = await g.sys.system.getSecret([ 'stripe.apiKey', 'common.connectionString.mysql_8' ]);
const staging = await g.sys.system.getSecret('stripe.apiKey', 'staging');   // from the secret named staging

key = await g.sys.system.get_secret('stripe.apiKey')
key2, cs = await g.sys.system.get_secrets(['stripe.apiKey', 'common.connectionString.mysql_8'])
staging = await g.sys.system.get_secret('stripe.apiKey', 'staging')  # from the secret named staging

$key = $g->sys->system->getSecret('stripe.apiKey');
[$key2, $cs] = $g->sys->system->getSecrets(['stripe.apiKey', 'common.connectionString.mysql_8']);
$staging = $g->sys->system->getSecret('stripe.apiKey', 'staging');  // from the secret named staging

var key = await g.Sys.System.GetSecret("stripe.apiKey");
var both = await g.Sys.System.GetSecrets(["stripe.apiKey", "common.connectionString.mysql_8"]);
var (key2, cs) = (both[0], both[1]);
var staging = await g.Sys.System.GetSecret("stripe.apiKey", "staging");  // from the secret named staging

key, err := g.Sys.System.GetSecret("stripe.apiKey")
if err != nil {
    return nil, err
}
both, err := g.Sys.System.GetSecrets([]string{"stripe.apiKey", "common.connectionString.mysql_8"})
if err != nil {
    return nil, err
}
key2, cs := both[0], both[1]
staging, err := g.Sys.System.GetSecret("stripe.apiKey", "staging") // from the secret named staging
if err != nil {
    return nil, err
}

let key = g.sys.system.get_secret("stripe.apiKey", None)?;
let both = g.sys.system.get_secrets(&["stripe.apiKey", "common.connectionString.mysql_8"], None)?;
let (key2, cs) = (&both[0], &both[1]);
let staging = g.sys.system.get_secret("stripe.apiKey", Some("staging"))?;  // from the secret named staging

Object key = g.sys.system.getSecret("stripe.apiKey");
List<Object> both = g.sys.system.getSecrets(List.of("stripe.apiKey", "common.connectionString.mysql_8"));
Object key2 = both.get(0), cs = both.get(1);
Object staging = g.sys.system.getSecret("stripe.apiKey", "staging");  // from the secret named staging

val key = g.sys.system.getSecret("stripe.apiKey")
val (key2, cs) = g.sys.system.getSecrets(listOf("stripe.apiKey", "common.connectionString.mysql_8"))
val staging = g.sys.system.getSecret("stripe.apiKey", "staging")  // from the secret named staging

Good to know¶

Secrets are never in Git and never in the answer of another API : this API is the way to read them, and it is a sensitive one. Grant it to the groups which need it, or read the secret from your code only (NO_ACCESS custom APIs).

Access, headers and errors¶

Over HTTP, a system API answers only once its settings open it : TOKEN_ACCESS (the token of an API user whose group grants this system API) or IS_PUBLIC. Without settings it is NO_ACCESS : only your code (g.sys) and the admin panel reach it.
The settings can also keep the answer in the cache, or ask for the token of a person (authProviders). Pre and post hooks run around it, as around any API.
It takes the request headers and answers the envelope. 401 : no valid token, or the API is NO_ACCESS. 403 : no group grants it. 400 : the body is wrong, and the message names the key.