> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openlit.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Secret(s)

> Fetches secret(s) using the provided key or tags.

## SDK usage

`url` and `api_key` (or `apiKey`) default to the `OPENLIT_URL` and `OPENLIT_API_KEY` environment variables if you don't pass them explicitly.

<Tabs>
  <Tab title="Python">
    ```python theme={null}
    import openlit

    response = openlit.get_secrets(
      should_set_env=True
    )

    print(response)
    ```

    ```shell Output theme={null}
    {
      err: null,
      res: { ANTHROPIC_API_KEY: 'ANTHROPIC_API_VALUE', OPENAI_API_KEY: 'OPENAI_API_VALUE' }
    }
    ```

    | Parameter        | Description                                                                                    |
    | ---------------- | ---------------------------------------------------------------------------------------------- |
    | `url`            | Sets the OpenLIT URL. Defaults to the `OPENLIT_URL` environment variable.                      |
    | `api_key`        | Sets the OpenLIT API Key. Can also be provided via the `OPENLIT_API_KEY` environment variable. |
    | `key`            | Sets the key to fetch a specific secret. Optional                                              |
    | `should_set_env` | Boolean value that sets all the secrets as environment variables for the application. Optional |
    | `tags`           | Sets the tags for fetching only the secrets that have the mentioned tags assigned. Optional    |

    `should_set_env` is client-side only: it doesn't change what's sent to OpenLIT, or what comes back in the response. It only controls whether the SDK, after receiving the secrets, also sets them directly as environment variables in your running process.
  </Tab>

  <Tab title="TypeScript">
    ```typescript theme={null}
    import Openlit from 'openlit';

    const response = await Openlit.getSecrets({
      shouldSetEnv: true,
    });

    console.log(response);
    ```

    ```shell Output theme={null}
    {
      err: null,
      res: { ANTHROPIC_API_KEY: 'ANTHROPIC_API_VALUE', OPENAI_API_KEY: 'OPENAI_API_VALUE' }
    }
    ```

    | Parameter      | Description                                                                                    |
    | -------------- | ---------------------------------------------------------------------------------------------- |
    | `url`          | Sets the OpenLIT URL. Defaults to the `OPENLIT_URL` environment variable.                      |
    | `apiKey`       | Sets the OpenLIT API Key. Can also be provided via the `OPENLIT_API_KEY` environment variable. |
    | `key`          | Sets the key to fetch a specific secret. Optional                                              |
    | `tags`         | Sets the tags for fetching only the secrets that have the mentioned tags assigned. Optional    |
    | `shouldSetEnv` | Boolean value that sets all the secrets as environment variables for the application. Optional |
  </Tab>
</Tabs>

<Note>
  This endpoint always responds successfully (HTTP 200), even for an invalid API key. Check the `err` field in the response body rather than relying on the HTTP status code alone to know whether the request actually succeeded.
</Note>

## Cross-origin browser requests

`POST /api/vault/get-secrets` is an API-key authenticated endpoint for retrieving Vault secrets. Browser requests from a different origin are blocked unless the calling origin is explicitly allowed.

To allow a browser application hosted on another domain, configure the OpenLIT deployment with a comma-separated origin allowlist:

```bash theme={null}
OPENLIT_ALLOWED_CORS_ORIGINS="https://app.example.com,https://admin.example.com"
```

`OPENLIT_ALLOWED_ORIGINS` is also supported as a backward-compatible alias. `NEXTAUTH_URL` is automatically treated as an allowed same-site origin.

Use complete origins such as `https://app.example.com`. Do not configure wildcard origins for this endpoint.

<Note>
  Server-to-server SDK or REST requests usually do not need CORS configuration because CORS is enforced by browsers.
</Note>


## OpenAPI

````yaml POST /api/vault/get-secrets
openapi: 3.0.0
info:
  title: Get Vault API
  description: An API to fetch secret(s) by providing necessary parameters.
  version: 1.0.0
servers:
  - url: http://localhost:3000
security: []
paths:
  /api/vault/get-secrets:
    post:
      summary: Get Secret(s)
      description: Fetches secret(s) using the provided key or tags.
      operationId: getSecrets
      requestBody:
        required: true
        content:
          text/plain:
            schema:
              type: object
              properties:
                key:
                  type: string
                  example: OPENAI_API_KEY
                tags:
                  type: array
                  items:
                    type: string
                  example:
                    - openai
      responses:
        '200':
          description: Successfully retrieved secret(s).
          content:
            application/json:
              schema:
                type: object
                properties:
                  err:
                    type: object
                    nullable: true
                  res:
                    type: object
                    example:
                      OPEN_API_KEY: OPEN_API_VALUE
      security:
        - apiKeyAuth: []
components:
  securitySchemes:
    apiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

````