Get Secret(s)

Fetches secret(s) using the provided key or tags.

POST /api/vault/get-secrets

Get Secret(s)

cURL

curl --request POST \
  --url http://localhost:3000/api/vault/get-secrets \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: text/plain' \
  --data '
{
  "key": "OPENAI_API_KEY",
  "tags": [
    "openai"
  ]
}
'

import requests

url = "http://localhost:3000/api/vault/get-secrets"

payload = {
    "key": "OPENAI_API_KEY",
    "tags": ["openai"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "text/plain"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'text/plain'},
  body: JSON.stringify({key: 'OPENAI_API_KEY', tags: ['openai']})
};

fetch('http://localhost:3000/api/vault/get-secrets', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_PORT => "3000",
  CURLOPT_URL => "http://localhost:3000/api/vault/get-secrets",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'key' => 'OPENAI_API_KEY',
    'tags' => [
        'openai'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: text/plain"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "http://localhost:3000/api/vault/get-secrets"

	payload := strings.NewReader("{\n  \"key\": \"OPENAI_API_KEY\",\n  \"tags\": [\n    \"openai\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "text/plain")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("http://localhost:3000/api/vault/get-secrets")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "text/plain")
  .body("{\n  \"key\": \"OPENAI_API_KEY\",\n  \"tags\": [\n    \"openai\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("http://localhost:3000/api/vault/get-secrets")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'text/plain'
request.body = "{\n  \"key\": \"OPENAI_API_KEY\",\n  \"tags\": [\n    \"openai\"\n  ]\n}"

response = http.request(request)
puts response.read_body

200

{
  "err": {},
  "res": {
    "OPEN_API_KEY": "OPEN_API_VALUE"
  }
}

SDK usage

url and api_key (or apiKey) default to the OPENLIT_URL and OPENLIT_API_KEY environment variables if you don’t pass them explicitly.

Python

import openlit

response = openlit.get_secrets(
  should_set_env=True
)

print(response)

Output

{
  err: null,
  res: { ANTHROPIC_API_KEY: 'ANTHROPIC_API_VALUE', OPENAI_API_KEY: 'OPENAI_API_VALUE' }
}

Parameter	Description
url	Sets the OpenLIT URL. Defaults to the OPENLIT_URL environment variable.
api_key	Sets the OpenLIT API Key. Can also be provided via the OPENLIT_API_KEY environment variable.
key	Sets the key to fetch a specific secret. Optional
should_set_env	Boolean value that sets all the secrets as environment variables for the application. Optional
tags	Sets the tags for fetching only the secrets that have the mentioned tags assigned. Optional

should_set_env is client-side only: it doesn’t change what’s sent to OpenLIT, or what comes back in the response. It only controls whether the SDK, after receiving the secrets, also sets them directly as environment variables in your running process.

TypeScript

import Openlit from 'openlit';

const response = await Openlit.getSecrets({
  shouldSetEnv: true,
});

console.log(response);

Output

{
  err: null,
  res: { ANTHROPIC_API_KEY: 'ANTHROPIC_API_VALUE', OPENAI_API_KEY: 'OPENAI_API_VALUE' }
}

Parameter	Description
url	Sets the OpenLIT URL. Defaults to the OPENLIT_URL environment variable.
apiKey	Sets the OpenLIT API Key. Can also be provided via the OPENLIT_API_KEY environment variable.
key	Sets the key to fetch a specific secret. Optional
tags	Sets the tags for fetching only the secrets that have the mentioned tags assigned. Optional
shouldSetEnv	Boolean value that sets all the secrets as environment variables for the application. Optional

This endpoint always responds successfully (HTTP 200), even for an invalid API key. Check the err field in the response body rather than relying on the HTTP status code alone to know whether the request actually succeeded.

Cross-origin browser requests

POST /api/vault/get-secrets is an API-key authenticated endpoint for retrieving Vault secrets. Browser requests from a different origin are blocked unless the calling origin is explicitly allowed.

To allow a browser application hosted on another domain, configure the OpenLIT deployment with a comma-separated origin allowlist:

OPENLIT_ALLOWED_CORS_ORIGINS="https://app.example.com,https://admin.example.com"

OPENLIT_ALLOWED_ORIGINS is also supported as a backward-compatible alias. NEXTAUTH_URL is automatically treated as an allowed same-site origin.

Use complete origins such as https://app.example.com. Do not configure wildcard origins for this endpoint.

Server-to-server SDK or REST requests usually do not need CORS configuration because CORS is enforced by browsers.

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

text/plain

key · string

Example:

"OPENAI_API_KEY"

tags · string[]

Example:

["openai"]

Response

200 - application/json

Successfully retrieved secret(s).

err · object | null

res · object

Example:

{ "OPEN_API_KEY": "OPEN_API_VALUE" }