Stripe: List secrets

← Apps operations · Get started

Operation stripe.getappssecrets

Provider route: GET /v1/apps/secrets. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/stripe with npm, or alter-sdk-stripe with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { StripeIntegration } from "@alter-ai/stripe";

async function execute(input: Parameters<StripeIntegration["apps"]["getAppsSecrets"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new StripeIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.apps.getAppsSecrets(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_stripe import StripeIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = StripeIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.apps.get_apps_secrets(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
query	object	Required within parent	Additional keys: not allowed
query.ending_before	string	Optional	Maximum length: 5000
query.expand	array	Optional
query.expand[]	string	Each item	Maximum length: 5000
query.limit	integer	Optional
query.scope	object	Required within parent
query.scope.type	string	Required within parent	One of: account, user
query.scope.user	string	Optional	Maximum length: 5000
query.starting_after	string	Optional	Maximum length: 5000

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	object	Root
data	array	Required within parent
data[]	Model	Each item	Expand Set a Secret — response body
has_more	boolean	Required within parent	True if this list has another page of items after this one that can be fetched.
object	string	Required within parent	String representing the object’s type. Objects of the same type share the same value. Always has the value `list`. Known values: list
url	string	Required within parent	The URL where this list can be accessed. Maximum length: 5000 Pattern: ^/v1/apps/secrets

Referenced models: Set a Secret — response body

Schemas

Set a Secret — response body

Field	Type	Presence	Description and constraints
$	object	Root	Secret Store is an API that allows Stripe Apps developers to securely persist secrets for use by UI Extensions and app backends. The primary resource in Secret Store is a `secret`. Other apps can't view secrets created by an app. Additionally, secrets are scoped to provide further permission control. All Dashboard users and the app backend share `account` scoped secrets. Use the `account` scope for secrets that don't change per-user, like a third-party API key. A `user` scoped secret is accessible by the app backend and one specific Dashboard user. Use the `user` scope for per-user secrets like per-user OAuth tokens, where different users might have different permissions. Related guide: [Store data between page reloads](https://docs.stripe.com/stripe-apps/store-auth-data-custom-objects)
created	JSON	Required within parent
created (anyOf 1)	integer	Alternative	Time at which the object was created. Measured in seconds since the Unix epoch. Format: unix-time
created (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
deleted	boolean	Optional	If true, indicates that this secret has been deleted
expires_at	JSON	Optional
expires_at (anyOf 1)	JSON	Alternative
expires_at (anyOf 1) (anyOf 1)	integer	Alternative	The Unix timestamp for the expiry time of the secret, after which the secret deletes. Format: unix-time
expires_at (anyOf 1) (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
expires_at (anyOf 2)	null	Alternative
id	string	Required within parent	Unique identifier for the object. Maximum length: 5000
livemode	boolean	Required within parent	If the object exists in live mode, the value is `true`. If the object exists in test mode, the value is `false`.
name	string	Required within parent	A name for the secret that's unique within the scope. Maximum length: 5000
object	string	Required within parent	String representing the object's type. Objects of the same type share the same value. Known values: apps.secret
payload	JSON	Optional
payload (anyOf 1)	string	Alternative	The plaintext secret value to be stored. Maximum length: 5000
payload (anyOf 2)	null	Alternative
scope	Model	Required within parent	Expand Set a Secret — response body — scope

Referenced models: Set a Secret — response body — scope

Set a Secret — response body — scope

Field	Type	Presence	Description and constraints
$	object	Root
type	string	Required within parent	The secret scope type. Known values: account, user
user	string	Optional	The user ID, if type is set to "user" Maximum length: 5000

Policy, approvals and errors

SDK function policy ID: stripe.getappssecrets. Catalog operation: GetAppsSecrets. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Refused by default. This operation leaves the caller holding a credential (Minted: expanding data.payload reads stored third-party secrets out of Stripe, usable outside the gateway.), so Alter refuses it on every connection with credential_minting_refused unless an organization admin allows it: a credential_minting rule naming provider stripe and operation stripe.getappssecrets (or GetAppsSecrets). See Allow an operation that hands over a credential.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"Stripe-Version": "2026-09-30.endive"}

Official provider source