Skip to content
This page View Markdown Open in ChatGPT Open in Claude

Get secret

Reads values of a secret by their path : common.encryptionAlgorithm, stripe.apiKey… One key gives its value, several give an array in the same order.
Method POST
URL /api/system-api/admin/get-secret-by-name : admin is the user path of your account
Body { keys } ; from code also fromSecretName
Answer data : the value, or an array of values
From code g.sys.system.getSecret

The call

Body : one key
{ "keys": "stripe.apiKey" }
Answer
{ "success": true, "statusCode": 200, "data": "sk_live_…" }
Body : several keys
{ "keys": [ "stripe.apiKey", "common.connectionString.mysql_8" ] }
Answer
{ "success": true, "statusCode": 200, "data": [ "sk_live_…", "mysql://…" ] }
  • keys is the full path in the secret object, with dots. A path to an object gives the object.
  • Over HTTP the default secret of the account answers. From code, fromSecretName reads another secret of the account by its name ; over HTTP that key is ignored.

From code

const key = await g.sys.system.getSecret('stripe.apiKey');
const [ key2, cs ] = await g.sys.system.getSecret([ 'stripe.apiKey', 'common.connectionString.mysql_8' ]);
const staging = await g.sys.system.getSecret('stripe.apiKey', 'staging');   // from the secret named staging

key = await g.sys.system.get_secret('stripe.apiKey')
key2, cs = await g.sys.system.get_secrets(['stripe.apiKey', 'common.connectionString.mysql_8'])
staging = await g.sys.system.get_secret('stripe.apiKey', 'staging')  # from the secret named staging

$key = $g->sys->system->getSecret('stripe.apiKey');
[$key2, $cs] = $g->sys->system->getSecrets(['stripe.apiKey', 'common.connectionString.mysql_8']);
$staging = $g->sys->system->getSecret('stripe.apiKey', 'staging');  // from the secret named staging

var key = await g.Sys.System.GetSecret("stripe.apiKey");
var both = await g.Sys.System.GetSecrets(["stripe.apiKey", "common.connectionString.mysql_8"]);
var (key2, cs) = (both[0], both[1]);
var staging = await g.Sys.System.GetSecret("stripe.apiKey", "staging");  // from the secret named staging

key, err := g.Sys.System.GetSecret("stripe.apiKey")
if err != nil {
    return nil, err
}
both, err := g.Sys.System.GetSecrets([]string{"stripe.apiKey", "common.connectionString.mysql_8"})
if err != nil {
    return nil, err
}
key2, cs := both[0], both[1]
staging, err := g.Sys.System.GetSecret("stripe.apiKey", "staging") // from the secret named staging
if err != nil {
    return nil, err
}

let key = g.sys.system.get_secret("stripe.apiKey", None)?;
let both = g.sys.system.get_secrets(&["stripe.apiKey", "common.connectionString.mysql_8"], None)?;
let (key2, cs) = (&both[0], &both[1]);
let staging = g.sys.system.get_secret("stripe.apiKey", Some("staging"))?;  // from the secret named staging

Object key = g.sys.system.getSecret("stripe.apiKey");
List<Object> both = g.sys.system.getSecrets(List.of("stripe.apiKey", "common.connectionString.mysql_8"));
Object key2 = both.get(0), cs = both.get(1);
Object staging = g.sys.system.getSecret("stripe.apiKey", "staging");  // from the secret named staging

val key = g.sys.system.getSecret("stripe.apiKey")
val (key2, cs) = g.sys.system.getSecrets(listOf("stripe.apiKey", "common.connectionString.mysql_8"))
val staging = g.sys.system.getSecret("stripe.apiKey", "staging")  // from the secret named staging

Good to know

  • Secrets are never in Git and never in the answer of another API : this API is the way to read them, and it is a sensitive one. Grant it to the groups which need it, or read the secret from your code only (NO_ACCESS custom APIs).

Access and settings

  • Over HTTP, a system API answers once its settings give it apiAccessType: TOKEN_ACCESS (the token of an API user whose group grants this system API, in x-am-authorization) or IS_PUBLIC. Without settings it is NO_ACCESS : your code calls it through g.sys, the admin panel tests it, and an HTTP call is refused.
  • The settings can also cache the answer or require person tokens (authProviders) ; pre and post hooks run around it like around any API.
  • The request headers apply : x-am-response-case, x-am-content-type-response, x-am-internationalization, x-am-tenant-username…

Errors

Code When
400 The body is wrong : the message names the missing or invalid key.
401 No valid API user token, or the API is NO_ACCESS : You are not authorized to access this API.
403 No group grants this system API.