API Reference
Secrets Secret management (encrypted key-value pairs)
Secret management (encrypted key-value pairs)
GET /api/v1/projects/{projectId}/environments/{environmentId}/secrets Returns all secrets in an environment (keys and metadata only, no values). Includes inherited secrets from parent environments.
Operation ID: listSecrets · Authentication: Authorization: Bearer <token>
Name Type Required Description projectIdstringyes Project UUID or slug (e.g., "my-project") environmentIdstringyes Environment UUID or name (e.g., "development", "staging", "production")
Status Description Body 200List of secrets object401Authentication required Error403Insufficient permissions Error404Resource not found Error
Field Type Description secretsobject[]
curl -X GET "https://api.keyenv.dev/api/v1/projects/{projectId}/environments/{environmentId}/secrets" \ -H "Authorization: Bearer $KEYENV_TOKEN " POST /api/v1/projects/{projectId}/environments/{environmentId}/secrets Creates a new secret in an environment
Operation ID: createSecret · Authentication: Authorization: Bearer <token>
Name Type Required Description projectIdstringyes Project UUID or slug (e.g., "my-project") environmentIdstringyes Environment UUID or name (e.g., "development", "staging", "production")
application/json (required)
Field Type Required Description keystringyes Must be uppercase letters, numbers, and underscores, starting with a letter valuestringyes descriptionstringno
Status Description Body 201Secret created object400Invalid request Error401Authentication required Error403Insufficient permissions Error409Resource already exists Error429Plan limit exceeded LimitError
Field Type Description secretSecret
curl -X POST "https://api.keyenv.dev/api/v1/projects/{projectId}/environments/{environmentId}/secrets" \ -H "Authorization: Bearer $KEYENV_TOKEN " \ -H "Content-Type: application/json" \ -d '{"key":"DATABASE_URL","value":"string","description":"string"}' GET /api/v1/projects/{projectId}/environments/{environmentId}/secrets/export Exports all secrets with their decrypted values. Use this for CI/CD or local development.
Includes inherited secrets from parent environments.
Note: This endpoint logs an audit event for compliance.
Operation ID: exportSecrets · Authentication: Authorization: Bearer <token>
Name Type Required Description projectIdstringyes Project UUID or slug (e.g., "my-project") environmentIdstringyes Environment UUID or name (e.g., "development", "staging", "production")
Status Description Body 200Secrets with values object401Authentication required Error403Insufficient permissions Error404Resource not found Error
Field Type Description secretsobject[]
curl -X GET "https://api.keyenv.dev/api/v1/projects/{projectId}/environments/{environmentId}/secrets/export" \ -H "Authorization: Bearer $KEYENV_TOKEN " GET /api/v1/projects/{projectId}/environments/{environmentId}/secrets/hashes Returns every secret (including inherited ones) with a keyed hash of its value instead of the plaintext,
for comparing environments. Hashes are HMAC-SHA256 with a server-side key derived from the encryption key
and scoped to the project, so equal values in the same project hash equal but cannot be brute-forced offline.
Requires read access to the environment. Plaintext is not returned, so no secret.read audit event is logged.
Operation ID: listSecretHashes · Authentication: Authorization: Bearer <token>
Name Type Required Description projectIdstringyes Project UUID or slug (e.g., "my-project") environmentIdstringyes Environment UUID or name (e.g., "development", "staging", "production")
Status Description Body 200Secret value hashes object401Authentication required Error403Insufficient permissions Error404Resource not found Error
Field Type Description dataobject[]
curl -X GET "https://api.keyenv.dev/api/v1/projects/{projectId}/environments/{environmentId}/secrets/hashes" \ -H "Authorization: Bearer $KEYENV_TOKEN " POST /api/v1/projects/{projectId}/environments/{environmentId}/secrets/bulk Imports multiple secrets at once. Useful for migrating from .env files or other systems.
Maximum 100 secrets per request
Set overwrite: true to update existing secrets
Set overwrite: false to skip existing secrets
Operation ID: bulkImportSecrets · Authentication: Authorization: Bearer <token>
Name Type Required Description projectIdstringyes Project UUID or slug (e.g., "my-project") environmentIdstringyes Environment UUID or name (e.g., "development", "staging", "production")
application/json (required)
Field Type Required Description secretsobject[]yes overwritebooleanno Whether to overwrite existing secrets
Status Description Body 200Import results BulkImportResult400Invalid request Error401Authentication required Error403Insufficient permissions Error429Plan limit exceeded LimitError
Field Type Description createdintegerNumber of secrets created updatedintegerNumber of secrets updated (when overwrite=true) skippedintegerNumber of secrets skipped (existing, when overwrite=false)
curl -X POST "https://api.keyenv.dev/api/v1/projects/{projectId}/environments/{environmentId}/secrets/bulk" \ -H "Authorization: Bearer $KEYENV_TOKEN " \ -H "Content-Type: application/json" \ -d '{"secrets":[{"key":"string","value":"string","description":"string"}],"overwrite":false}' GET /api/v1/projects/{projectId}/environments/{environmentId}/secrets/{key} Returns a single secret with its decrypted value
Operation ID: getSecret · Authentication: Authorization: Bearer <token>
Name Type Required Description projectIdstringyes Project UUID or slug (e.g., "my-project") environmentIdstringyes Environment UUID or name (e.g., "development", "staging", "production") keystringyes Secret key (uppercase letters, numbers, underscores)
Status Description Body 200Secret with value object401Authentication required Error403Insufficient permissions Error404Resource not found Error
Field Type Description secretobject
curl -X GET "https://api.keyenv.dev/api/v1/projects/{projectId}/environments/{environmentId}/secrets/{key}" \ -H "Authorization: Bearer $KEYENV_TOKEN " PUT /api/v1/projects/{projectId}/environments/{environmentId}/secrets/{key} Updates a secret's value and/or description. Previous values are preserved in history.
Operation ID: updateSecret · Authentication: Authorization: Bearer <token>
Name Type Required Description projectIdstringyes Project UUID or slug (e.g., "my-project") environmentIdstringyes Environment UUID or name (e.g., "development", "staging", "production") keystringyes Secret key (uppercase letters, numbers, underscores)
application/json (required)
Field Type Required Description valuestringyes descriptionstringno
Status Description Body 200Secret updated object400Invalid request Error401Authentication required Error403Insufficient permissions Error404Resource not found Error
Field Type Description secretSecret
curl -X PUT "https://api.keyenv.dev/api/v1/projects/{projectId}/environments/{environmentId}/secrets/{key}" \ -H "Authorization: Bearer $KEYENV_TOKEN " \ -H "Content-Type: application/json" \ -d '{"value":"string","description":"string"}' DELETE /api/v1/projects/{projectId}/environments/{environmentId}/secrets/{key} Permanently deletes a secret
Operation ID: deleteSecret · Authentication: Authorization: Bearer <token>
Name Type Required Description projectIdstringyes Project UUID or slug (e.g., "my-project") environmentIdstringyes Environment UUID or name (e.g., "development", "staging", "production") keystringyes Secret key (uppercase letters, numbers, underscores)
Status Description Body 204Secret deleted 401Authentication required Error403Insufficient permissions Error404Resource not found Error
curl -X DELETE "https://api.keyenv.dev/api/v1/projects/{projectId}/environments/{environmentId}/secrets/{key}" \ -H "Authorization: Bearer $KEYENV_TOKEN " GET /api/v1/projects/{projectId}/environments/{environmentId}/secrets/{key}/history Returns the version history of a secret with decrypted values
Operation ID: getSecretHistory · Authentication: Authorization: Bearer <token>
Name Type Required Description projectIdstringyes Project UUID or slug (e.g., "my-project") environmentIdstringyes Environment UUID or name (e.g., "development", "staging", "production") keystringyes Secret key (uppercase letters, numbers, underscores)
Status Description Body 200Secret history object401Authentication required Error403Insufficient permissions Error404Resource not found Error
Field Type Description historyobject[]
curl -X GET "https://api.keyenv.dev/api/v1/projects/{projectId}/environments/{environmentId}/secrets/{key}/history" \ -H "Authorization: Bearer $KEYENV_TOKEN " 