Retrieve an Auth Key secret
Returns the secret for a selected Auth Key.
https://api2.transloadit.com/Reveals a secret once, only when can_show_auth_secret is enabled on the selected key.
Successful retrieval immediately clears that permission. A retry after a lost successful
response cannot retrieve the secret again and returns AUTH_SECRET_NOT_RETRIEVED.
This is not a repeatable secret lookup. Store the secret securely from the creation or reveal response.
Request example
Set AUTH_KEY_ID to your resource value without percent-encoding it.
Run this request in a server-side shell with curl and a suitable bearer token in TRANSLOADIT_TOKEN. If you need a token, expand the setup below.
Need a bearer token?
In a trusted server-side shell with curl and jq, set TRANSLOADIT_KEY and TRANSLOADIT_SECRET to your Auth Key and Auth Secret. Keep both credentials and the resulting token secret; never run this setup in browser code.
First, create a token with this endpoint’s required scopes. Your Auth Key must already grant those scopes.
if ! TOKEN_RESPONSE="$(curl --fail-with-body -sS \
--request POST \
--url 'https://api2.transloadit.com/token' \
--user "${TRANSLOADIT_KEY:?Set TRANSLOADIT_KEY}:${TRANSLOADIT_SECRET:?Set TRANSLOADIT_SECRET}" \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'aud=api2' \
--data-urlencode 'scope=auth_keys:read')"; then
printf '%s\n' "$TOKEN_RESPONSE" >&2
exit 1
fi
TRANSLOADIT_TOKEN="$(printf '%s' "$TOKEN_RESPONSE" |
jq -er '.access_token | strings | select(length > 0)')" || exit 1
Keep this shell open and run the request below. Reuse the token while it remains valid.
curl --fail-with-body -sS --request POST \
--url "https://api2.transloadit.com/auth_keys/show_secret/${AUTH_KEY_ID:?Set AUTH_KEY_ID}" \
--header "Authorization: Bearer ${TRANSLOADIT_TOKEN:?Set TRANSLOADIT_TOKEN}" \
--data-urlencode 'params={}'
Authentication
This endpoint accepts signed params or a bearer token. See Authentication for setup instructions.
Required scope for the Auth Key or bearer token: auth_keys:read.
Signed requests require both a signature and a future params.auth.expires timestamp. Bearer tokens do not require either.
Path parameters
authKeyId(path segment), required. pattern:^[0-9a-f]{32}$, minimum length: 32, maximum length: 32
Form fields
Content type: application/x-www-form-urlencoded
params(JSON string), required. A JSON-encoded object whose supported keys are listed below.signature(string). Required for signed requests. Omit this field when using a bearer token.
Supported keys inside the params field
Authentication fields in this list apply to signed requests. With a bearer token, you can omit params.auth and the separate signature field. Compare the authentication-specific request parameters below.
Complete JSON Schema
params: Only the fields listed for this object are accepted.
| Field | Type and description |
|---|---|
params.required for signed requests; optional with a bearer token | Contains the Transloadit API key and signature-authentication metadata for an Auth Keys request.
|
params.required | stringISO 8601 expiration timestamp in the future. Required when a request is signed or requires signature authentication; bearer-authenticated requests may omit it. |
params.required | stringTransloadit API key used to authenticate requests |
params. | string | integerUnique, random value included in signed request params to make each signature unique and prevent accidental signature reuse. |
params. | string | integerUnique, random value included in signed request params to make each signature unique and prevent accidental signature reuse. |
Request parameters by authentication method
With signed params
Include your Auth Key as params.auth.key. When signing the request, include a future params.auth.expires timestamp and send the signature in the separate signature field. The field definitions below use paths inside params.
Complete JSON Schema
params: Only the fields listed for this object are accepted.
Uses the field definitions above: params.auth, params.nonce
With a bearer token
Send the bearer token in the Authorization header. You can omit params.auth and the separate signature field. Other required parameters still apply. The field definitions below use paths inside params.
Complete JSON Schema
params: Only the fields listed for this object are accepted.
Uses the field definitions above: params.nonce
| Field | Type and description |
|---|---|
params. | Contains the Transloadit API key and signature-authentication metadata for an Auth Keys request.
|
params. | stringISO 8601 expiration timestamp in the future. Required when a request is signed or requires signature authentication; bearer-authenticated requests may omit it. |
params. | stringTransloadit API key used to authenticate requests |
params. | string | integerUnique, random value included in signed request params to make each signature unique and prevent accidental signature reuse. |
Response
Here’s an example response body:
{
"auth_key": "example_auth_key",
"auth_secret": "example_secret_store_securely",
"message": "Your auth secret could be retrieved.",
"ok": "AUTH_SECRET_RETRIEVED"
}2xx success
JSON response body. application/json text/plain; charset=utf-8
Response body schema
Complete JSON Schema
The response may contain additional fields.
| Field | Type and description |
|---|---|
auth_keyrequired | string | null (maximum length: 64)Validation pattern (regular expression)^[\u0000-\ud7ff\ue000-\uffff]*$ |
auth_secretrequired | string |
messagerequired | string (minimum length: 1) |
okrequired | string (always: "AUTH_SECRET_RETRIEVED") |
Error response
JSON response body. application/json text/plain; charset=utf-8
Response body schema
Complete JSON Schema
The response may contain additional fields.
| Field | Type and description |
|---|---|
assembly_id | string |
error | string (minimum length: 1) |
http_code | number | string
|
message | stringHuman-readable explanation of the error. Its wording can vary; use the |
reason | null | string | number | boolean | Array<any value> | objectAny of the following schemas may apply: nullnullstringstringnumbernumberbooleanbooleanArray<any value>Array<any value>Array item schemaany valueobjectobjectAdditional property schemaany value |
HTTP 400
JSON response body. application/json text/plain; charset=utf-8
Response body schema
Complete JSON Schema
Named errors and the general error format
error: "AUTH_SECRET_NOT_RETRIEVED"
Your auth secret could not be shown.
The response may contain additional fields.