putty
API ReferenceLedger

Read one secret's metadata

Returns one secret's metadata. There is no endpoint anywhere in the API that returns a value; this is the closest thing to one, and it stops at `lastUsedAt`. Pass `?projectId=` to read the project-scoped secret of that name rather than the user-scoped one.

GET
/secrets/{name}

Returns one secret's metadata. There is no endpoint anywhere in the API that returns a value; this is the closest thing to one, and it stops at lastUsedAt. Pass ?projectId= to read the project-scoped secret of that name rather than the user-scoped one.

Authorization

bearerAuth
AuthorizationBearer <token>

A bearer token. The Account routes accept a Privy access token; the MCP transport accepts an sk- API key issued by POST /account/api-keys.

In: header

Path Parameters

name*string

The environment-variable-shaped name of the secret. PRIVATE_KEY, MNEMONIC, and SEED_PHRASE are refused.

Match^[A-Z][A-Z0-9_]{0,63}$

Query Parameters

projectId?string

Read the project-scoped secret of this name instead of the user-scoped one.

Length1 <= length

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/secrets/string"
{  "id": "string",  "name": "string",  "scope": "user",  "projectId": "string",  "description": "string",  "usage": "sandbox",  "status": "string",  "createdAt": "string",  "updatedAt": "string",  "lastUsedAt": "string"}

List the caller's secrets GET

Returns the caller's secrets by name and metadata. Values are never included at any depth. Pass `?projectId=` to include that project's secrets as well; a project secret and a user secret of the same name both appear, and the project one is the one that wins inside that project.

Delete a secret DELETE

Removes the secret and its value. Pass `?projectId=` to delete the project-scoped secret of that name; without it the user-scoped secret is removed. Answers 404 for a secret that is not the caller's, the same as for one that does not exist.