curl --request POST \
--url https://app.base44.com/api/apps/{app_id}/secrets \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"STRIPE_SECRET_KEY": "sk_live_51H...",
"SENDGRID_API_KEY": "SG.x9..."
}
'import requests
url = "https://app.base44.com/api/apps/{app_id}/secrets"
payload = {
"STRIPE_SECRET_KEY": "sk_live_51H...",
"SENDGRID_API_KEY": "SG.x9..."
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({STRIPE_SECRET_KEY: 'sk_live_51H...', SENDGRID_API_KEY: 'SG.x9...'})
};
fetch('https://app.base44.com/api/apps/{app_id}/secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/secrets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'STRIPE_SECRET_KEY' => 'sk_live_51H...',
'SENDGRID_API_KEY' => 'SG.x9...'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.base44.com/api/apps/{app_id}/secrets"
payload := strings.NewReader("{\n \"STRIPE_SECRET_KEY\": \"sk_live_51H...\",\n \"SENDGRID_API_KEY\": \"SG.x9...\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/secrets")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"STRIPE_SECRET_KEY\": \"sk_live_51H...\",\n \"SENDGRID_API_KEY\": \"SG.x9...\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.base44.com/api/apps/{app_id}/secrets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"STRIPE_SECRET_KEY\": \"sk_live_51H...\",\n \"SENDGRID_API_KEY\": \"SG.x9...\"\n}"
response = http.request(request)
puts response.read_body{
"success": true
}Set secret
Stores one or more secrets on the app and makes them available to its backend functions as environment variables. Send several at once by putting several keys in the body.
A name that already exists is overwritten, so this both creates and updates. Names must be uppercase letters, digits, and underscores, and must start with a letter, for example STRIPE_SECRET_KEY. Some names are reserved by Base44 and are rejected.
Setting a secret redeploys the app’s backend functions so they pick up the new value.
curl --request POST \
--url https://app.base44.com/api/apps/{app_id}/secrets \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"STRIPE_SECRET_KEY": "sk_live_51H...",
"SENDGRID_API_KEY": "SG.x9..."
}
'import requests
url = "https://app.base44.com/api/apps/{app_id}/secrets"
payload = {
"STRIPE_SECRET_KEY": "sk_live_51H...",
"SENDGRID_API_KEY": "SG.x9..."
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({STRIPE_SECRET_KEY: 'sk_live_51H...', SENDGRID_API_KEY: 'SG.x9...'})
};
fetch('https://app.base44.com/api/apps/{app_id}/secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/secrets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'STRIPE_SECRET_KEY' => 'sk_live_51H...',
'SENDGRID_API_KEY' => 'SG.x9...'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.base44.com/api/apps/{app_id}/secrets"
payload := strings.NewReader("{\n \"STRIPE_SECRET_KEY\": \"sk_live_51H...\",\n \"SENDGRID_API_KEY\": \"SG.x9...\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/secrets")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"STRIPE_SECRET_KEY\": \"sk_live_51H...\",\n \"SENDGRID_API_KEY\": \"SG.x9...\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.base44.com/api/apps/{app_id}/secrets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"STRIPE_SECRET_KEY\": \"sk_live_51H...\",\n \"SENDGRID_API_KEY\": \"SG.x9...\"\n}"
response = http.request(request)
puts response.read_body{
"success": true
}Authorizations
Personal access token, sent as Authorization: Bearer <token>. Each operation lists the permission it needs: read_only or full_access. A full-access token can call every operation. A read-only token can call only the operations that list read_only; anything else returns 403 read_only_credential_route_not_allowed.
Path Parameters
ID of the app to set the secret on.
Body
Each key is a secret name and each value is the secret itself.
Response
Successful Response
Confirmation that the secrets were stored.
Whether the secrets were stored.
true
Was this page helpful?