> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List secrets

> <Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Returns the names of the secrets stored on the app.

Values are never returned. Every name maps to the same masked placeholder, `••••••••`, so use this to check which secrets are set, not what they hold. The list covers every secret stored on the app, including ones Base44 generated or an integration stored, not only the ones you set with [Set secret](/api-reference/set-secret). Remove one with [Delete secret](/api-reference/delete-secret).

<Note>This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted.</Note>



## OpenAPI

````yaml /developers/references/app-management/app-management-openapi.json get /api/apps/{app_id}/secrets
openapi: 3.1.0
info:
  title: Base44 App Management API
  version: 1.0.0
servers:
  - url: https://app.base44.com
security:
  - PersonalAccessTokenAuth: []
paths:
  /api/apps/{app_id}/secrets:
    get:
      summary: List secrets
      description: >-
        <Info>This API is in beta. Endpoints, fields, and behavior may still
        change, so avoid depending on it in production.</Info>


        Returns the names of the secrets stored on the app.


        Values are never returned. Every name maps to the same masked
        placeholder, `••••••••`, so use this to check which secrets are set, not
        what they hold. The list covers every secret stored on the app,
        including ones Base44 generated or an integration stored, not only the
        ones you set with [Set secret](/api-reference/set-secret). Remove one
        with [Delete secret](/api-reference/delete-secret).


        <Note>This endpoint accepts a personal API key belonging to a user with
        editor access to the app. A read-only key is refused, and workspace API
        keys are not accepted.</Note>
      operationId: get_app_secrets_api_api_apps__app_id__secrets_get
      parameters:
        - name: app_id
          in: path
          required: true
          schema:
            type: string
            description: ID of the app whose secrets you want to list.
            title: App Id
          description: ID of the app whose secrets you want to list.
          example: 6820f3a4e7b91d003c45a1f2
      responses:
        '200':
          description: The names of the app's secrets.
          content:
            application/json:
              schema:
                type: object
                title: SecretNames
                description: >-
                  Each key is a secret name, and each value is the masked
                  placeholder `••••••••`.
                additionalProperties:
                  type: string
              example:
                STRIPE_SECRET_KEY: ••••••••
                SENDGRID_API_KEY: ••••••••
        '401':
          description: Missing or invalid credentials.
        '403':
          description: >-
            You don't have editor access to this app, or your API key is
            read-only.
        '404':
          description: App not found.
components:
  securitySchemes:
    PersonalAccessTokenAuth:
      type: http
      scheme: bearer
      description: 'Personal access token, sent as `Authorization: Bearer <token>`.'

````