> ## Documentation Index
> Fetch the complete documentation index at: https://hyperbrowser.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get the secrets public key

> Get the RSA public key you encrypt secret values to.

See the [secrets guide](/docs/sandboxes/secrets) for SDK and CLI examples, and [credential fill](/docs/sessions/credentials) for website logins.


## OpenAPI

````yaml openapi.json GET /api/secrets/public-key
openapi: 3.0.1
info:
  title: Hyperbrowser API
  version: 1.0.0
servers:
  - url: https://api.hyperbrowser.ai
    description: Production server
security: []
paths:
  /api/secrets/public-key:
    get:
      summary: Get the secrets public key
      description: >-
        Returns the RSA public key that you encrypt secret values to before
        uploading them with POST /api/secrets/{id}/versions. Doesn't require
        authentication. Don't cache the key: after a key rotation, uploads
        encrypted to the old key return 409 SECRET_KEY_OUTDATED, and you fetch
        the key again.
      operationId: getSecretsPublicKey
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretsPublicKey'
        '503':
          description: 'SECRETS_NOT_CONFIGURED: secrets aren''t available on this deployment.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretErrorResponse'
components:
  schemas:
    SecretsPublicKey:
      type: object
      properties:
        kid:
          type: string
          description: >-
            Key ID: the RFC 7638 SHA-256 thumbprint of the key. Put it in the
            `kid` header of your envelopes.
        alg:
          type: string
          enum:
            - RSA-OAEP-256
        enc:
          type: string
          enum:
            - A256GCM
        jwk:
          type: object
          description: The RSA public key (at least 3072 bits) as a JWK.
          properties:
            kty:
              type: string
              enum:
                - RSA
            'n':
              type: string
            e:
              type: string
            kid:
              type: string
            alg:
              type: string
              enum:
                - RSA-OAEP-256
            use:
              type: string
              enum:
                - enc
          required:
            - kty
            - 'n'
            - e
            - kid
            - alg
            - use
      required:
        - kid
        - alg
        - enc
        - jwk
    SecretErrorResponse:
      type: object
      properties:
        code:
          type: string
          description: Machine-readable error code, such as SECRET_NOT_FOUND.
        message:
          type: string
        error:
          type: string
          description: >-
            Set instead of `code` by authentication and API key scope errors
            (API_KEY_SCOPE_DENIED).
        requiredScopes:
          type: array
          items:
            type: string
          description: The scope the API key is missing, with API_KEY_SCOPE_DENIED.
        retryable:
          type: boolean
          description: >-
            Whether repeating the same request can succeed. Set on delivery
            errors.
        details:
          type: object
          additionalProperties: true
          description: >-
            Extra information for some codes, such as `origin` for
            CREDENTIAL_ORIGIN_NOT_ALLOWED or `pages` for
            CREDENTIAL_PAGE_AMBIGUOUS.
      description: >-
        HTTP failure. Secret errors include `code` and `message`; request
        validation errors include only `message`; API key scope errors include
        `error`, `message` and `requiredScopes`.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.