Secrets

Secret Store is an API that allows Stripe Apps developers to securely persist secrets for use by UI Extensions and app backends.

The primary resource in Secret Store is a secret. Other apps can’t view secrets created by an app. Additionally, secrets are scoped to provide further permission control.

All Dashboard users and the app backend share account scoped secrets. Use the account scope for secrets that don’t change per-user, like a third-party API key.

A user scoped secret is accessible by the app backend and one specific Dashboard user. Use the user scope for per-user secrets like per-user OAuth tokens, where different users might have different permissions.

Related guide: Store data between page reloads

Was this section helpful? Yes No

List secrets

GET / v1 / apps / secrets

Delete a Secret

POST / v1 / apps / secrets / delete

Find a Secret

GET / v1 / apps / secrets / find

Set a Secret

POST / v1 / apps / secrets

The Secret object

Attributes

• id string Unique identifier for the object.
• object string, value is "apps.secret" String representing the object’s type. Objects of the same type share the same value.
• created timestamp Time at which the object was created. Measured in seconds since the Unix epoch.
• deleted nullable boolean If true, indicates that this secret has been deleted
• expires _ at nullable timestamp The Unix timestamp for the expiry time of the secret, after which the secret deletes.
• livemode boolean If the object exists in live mode, the value is true. If the object exists in test mode, the value is false.
• name string A name for the secret that’s unique within the scope.
• payload nullable string Includable The plaintext secret value to be stored.
• scope object Specifies the scoping of the secret. Requests originating from UI extensions can only access account-scoped secrets or secrets scoped to their own user.

The Secret object

{ "id": "appsecret_5110hHS1707T6fjBnah1LkdIwHu7ix", "object": "apps.secret", "created": 1680209063, "expires_at": null, "livemode": false, "name": "my-api-key", "scope": { "type": "account" }}

List secrets

GET / v1 / apps / secrets

List all secrets stored on the given scope.

Parameters

• scope object Required Specifies the scoping of the secret. Requests originating from UI extensions can only access account-scoped secrets or secrets scoped to their own user.

More parameters

• ending _ before string
• limit integer
• starting _ after string

Returns

A dictionary with a data property that contains an array of up to limit Secrets, starting after Secret starting_after. Each entry in the array is a separate Secret object. If no more Secrets are available, the resulting array will be empty.

Response