Stripe: Delete a Secret

← Apps operations · Get started

Operation stripe.postappssecretsdelete

Provider route: POST /v1/apps/secrets/delete. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/stripe with npm, or alter-sdk-stripe with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { StripeIntegration } from "@alter-ai/stripe";

async function execute(input: Parameters<StripeIntegration["apps"]["postAppsSecretsDelete"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new StripeIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.apps.postAppsSecretsDelete(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_stripe import StripeIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = StripeIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.apps.post_apps_secrets_delete(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
headers	object	Optional	Additional keys: not allowed
headers.Idempotency-Key	string	Optional	Minimum length: 1 Maximum length: 255
body	object	Required within parent	Additional keys: not allowed
body.expand	array	Optional	Specifies which fields in the response should be expanded.
body.expand[]	string	Each item	Maximum length: 5000
body.name	string	Required within parent	A name for the secret that’s unique within the scope. Maximum length: 5000
body.scope	object	Required within parent	Specifies the scoping of the secret. Requests originating from UI extensions can only access account-scoped secrets or secrets scoped to their own user.
body.scope.type	string	Required within parent	One of: account, user
body.scope.user	string	Optional	Maximum length: 5000

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Set a Secret — response body

Referenced models: Set a Secret — response body

Schemas

Set a Secret — response body

Field	Type	Presence	Description and constraints
$	object	Root	Secret Store is an API that allows Stripe Apps developers to securely persist secrets for use by UI Extensions and app backends. The primary resource in Secret Store is a `secret`. Other apps can't view secrets created by an app. Additionally, secrets are scoped to provide further permission control. All Dashboard users and the app backend share `account` scoped secrets. Use the `account` scope for secrets that don't change per-user, like a third-party API key. A `user` scoped secret is accessible by the app backend and one specific Dashboard user. Use the `user` scope for per-user secrets like per-user OAuth tokens, where different users might have different permissions. Related guide: [Store data between page reloads](https://docs.stripe.com/stripe-apps/store-auth-data-custom-objects)
created	JSON	Required within parent
created (anyOf 1)	integer	Alternative	Time at which the object was created. Measured in seconds since the Unix epoch. Format: unix-time
created (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
deleted	boolean	Optional	If true, indicates that this secret has been deleted
expires_at	JSON	Optional
expires_at (anyOf 1)	JSON	Alternative
expires_at (anyOf 1) (anyOf 1)	integer	Alternative	The Unix timestamp for the expiry time of the secret, after which the secret deletes. Format: unix-time
expires_at (anyOf 1) (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
expires_at (anyOf 2)	null	Alternative
id	string	Required within parent	Unique identifier for the object. Maximum length: 5000
livemode	boolean	Required within parent	If the object exists in live mode, the value is `true`. If the object exists in test mode, the value is `false`.
name	string	Required within parent	A name for the secret that's unique within the scope. Maximum length: 5000
object	string	Required within parent	String representing the object's type. Objects of the same type share the same value. Known values: apps.secret
payload	JSON	Optional
payload (anyOf 1)	string	Alternative	The plaintext secret value to be stored. Maximum length: 5000
payload (anyOf 2)	null	Alternative
scope	Model	Required within parent	Expand Set a Secret — response body — scope

Referenced models: Set a Secret — response body — scope

Set a Secret — response body — scope

Field	Type	Presence	Description and constraints
$	object	Root
type	string	Required within parent	The secret scope type. Known values: account, user
user	string	Optional	The user ID, if type is set to "user" Maximum length: 5000

Policy, approvals and errors

SDK function policy ID: stripe.postappssecretsdelete. Catalog operation: PostAppsSecretsDelete. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"Stripe-Version": "2026-09-30.endive"}

Official provider source