# GET /v1/secrets

> Secret names, never the values: the company's, or one user's (user_id).

In [MCP servers and secrets API](https://vestra.ai/developers/reference/api/mcp-servers-and-secrets.md): Your MCP servers and the tools they offer, and the secrets Bash uses but never shows.

Send `Authorization: Bearer vk_test_...` on every call.

Secret names, never the values: the company's, or one user's (user_id).

Your API key, scope `setup` or `all`. On the card: [`secrets`](https://vestra.ai/developers/secrets.md). Every call here is a checked sample.

## Request

Query:

- `limit` (`integer`): How many items per page, 1 to 100. Default 20.
- `cursor` (`string`): Where to go on from: the `next_cursor` of the page before, unchanged. Absent: the first page.
- `user_id` (`string`): Whose secret: your id for the user, for their own (read as `${user_secret:NAME}`). Absent: your company's (read as `${secret:NAME}`).

## Answers 200

- `data` (`object[]`): The items on this page.
  - `object` (`"secret"`): Always `secret`.
  - `name` (`string`): The secret's name. Example: `PNR_API_KEY`.
  - `user_id` (`string | null`): Your id for the user whose secret it is; null for your company's.
  - `mode` (`"live" | "test"`): The mode it is kept in: a live key reads live secrets, a test key test ones.
- `next_cursor` (`string | null`): Send it as `cursor` for the next page; null on the last page.

## Code

**TypeScript**

```ts
const secrets = await vestra.secrets.list();
```

**Python**

```python
secrets = vestra.secrets.list()
```

**CLI**

```bash
vestra secrets
```

**HTTP**

```bash
# Store a company secret. Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.
curl -X PUT "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \
  -H "Authorization: Bearer $VESTRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "value": "your-token" }'

# Store a user's secret. It is for their own account, as ${user_secret:IRCTC_TOKEN}.
curl -X PUT "$VESTRA_BASE_URL/v1/secrets/IRCTC_TOKEN" \
  -H "Authorization: Bearer $VESTRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "user_id": "traveller-42", "value": "token-from-their-account" }'

# List and delete secrets. The list shows names only, never values.
curl "$VESTRA_BASE_URL/v1/secrets" \
  -H "Authorization: Bearer $VESTRA_API_KEY"

curl -X DELETE "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \
  -H "Authorization: Bearer $VESTRA_API_KEY"
```

**MCP**: No sample in your language for this route, so here it is over HTTP.