# Secrets (https://developer.godaddy.com/en/docs/references/rest/nodejs-hosting/secrets)

***

title: Secrets
description: Manage environment secrets per variant. Values are never returned.
full: true
\_openapi:
toc:

* depth: 2
  title: List app secrets (metadata only)
  url: '#list-app-secrets-metadata-only'
* depth: 2
  title: Add, update, or delete app secrets
  url: '#add-update-or-delete-app-secrets'
  structuredData:
  headings:
  * content: List app secrets (metadata only)
    id: list-app-secrets-metadata-only
  * content: Add, update, or delete app secrets
    id: add-update-or-delete-app-secrets
    contents: \[]

***

## GET /apps/{appId}/secrets

List app secrets (metadata only)

### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `appId` | string | yes |  |

### Query parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `variant` | string | no |  |

### Responses

**200** — Secret names and metadata (values never returned)

Content-Type: `application/json`

Schema:

- object
  - `shared` (required): object
      - `secrets` (required): array
          - items:
              - `name` (required): string
              - `systemManaged` (required): boolean
              - `createdAt`: string
              - `updatedAt`: string
  - `variants` (required): object
      - `preview`: object
          - `secrets` (required): array
              - items:
                  - `name` (required): string
                  - `systemManaged` (required): boolean
                  - `createdAt`: string
                  - `updatedAt`: string
      - `publish`: object
          - `secrets` (required): array
              - items:
                  - `name` (required): string
                  - `systemManaged` (required): boolean
                  - `createdAt`: string
                  - `updatedAt`: string

**401** — Unauthorized (missing session, invalid API key or Bearer token, or insufficient OAuth scope)

**404** — Not found

**429** — Too many requests. Limit: 60 requests per minute per client IP. X-RateLimit-* headers are returned on successful responses as well.

Content-Type: `application/json`

Schema:

- object
  - `error` (required): string
  - `code` (required): string
    - enum: "RATE_LIMITED"
  - `detail` (required): string

**Security:** requires `oauth2`; scopes `hosting.paas.secrets:write`.

## POST /apps/{appId}/secrets

Add, update, or delete app secrets

### Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `appId` | string | yes |  |

### Request body (required)

Content-Type: `application/json`

Schema:

- object
  - `variant` (required): string
    - enum: "preview", "publish"
  - `operations` (required): object
      - `additions` (required): array
          - items:
              - `name` (required): string
              - `value` (required): string
      - `updates` (required): array
          - items:
              - `name` (required): string
              - `value` (required): string
      - `deletions` (required): array
          - items:
              - `name` (required): string

### Responses

**200** — Updated secret metadata

Content-Type: `application/json`

Schema:

- object
  - `shared` (required): object
      - `secrets` (required): array
          - items:
              - `name` (required): string
              - `systemManaged` (required): boolean
              - `createdAt`: string
              - `updatedAt`: string
  - `variants` (required): object
      - `preview`: object
          - `secrets` (required): array
              - items:
                  - `name` (required): string
                  - `systemManaged` (required): boolean
                  - `createdAt`: string
                  - `updatedAt`: string
      - `publish`: object
          - `secrets` (required): array
              - items:
                  - `name` (required): string
                  - `systemManaged` (required): boolean
                  - `createdAt`: string
                  - `updatedAt`: string

**401** — Unauthorized (missing session, invalid API key or Bearer token, or insufficient OAuth scope)

**404** — Not found

**429** — Too many requests. Limit: 10 requests per minute per client IP. X-RateLimit-* headers are returned on successful responses as well.

Content-Type: `application/json`

Schema:

- object
  - `error` (required): string
  - `code` (required): string
    - enum: "RATE_LIMITED"
  - `detail` (required): string

**Security:** requires `oauth2`; scopes `hosting.paas.secrets:write`.