7 · Secret Manager

Fetch the encrypted Master Encryption Key (MEK) for an app.

Scope: full-access or secret-read

Path param: appId — the App ID from the secret manager dashboard (set as {{appId}} in your environment)

Success — 200 OK

{
  "encryptedMek": "<base64-encoded-encrypted-key>",
  "algorithm": "AES-256-GCM",
  "kdfAlgorithm": "HKDF-SHA256"
}

Decrypt the MEK using your App Secret:

const mek = await crypto.subtle.decrypt(
  { name: 'AES-GCM', iv: decodeBase64(iv) },
  await deriveKey(appSecret),  // HKDF-SHA256
  decodeBase64(encryptedMek)
);

Common errors

• 401 — invalid API key
• 403 — key lacks secret-read scope
• 404 — app not found
• 429 — rate limited (50 req/hour)

Fetch encrypted environment variables for an app.

Scope: full-access or secret-read

Path param: appId — App ID from dashboard Query param: environment (optional) — development | staging | production (default: development)

Success — 200 OK

{
  "environment": "production",
  "variables": [
    { "key": "DATABASE_URL", "encryptedValue": "<base64>", "iv": "<base64>" },
    { "key": "STRIPE_SECRET_KEY", "encryptedValue": "<base64>", "iv": "<base64>" }
  ]
}

Decrypt each variable using the MEK from GET master-key:

const plaintext = await crypto.subtle.decrypt(
  { name: 'AES-GCM', iv: decodeBase64(variable.iv) },
  mek,
  decodeBase64(variable.encryptedValue)
);

Common errors

• 401 — invalid API key
• 403 — key lacks secret-read scope
• 404 — app not found or no variables for this environment