|
| 1 | +--- |
| 2 | +title: Secrets stores |
| 3 | +description: Covers usage for the Secrets store API. |
| 4 | +--- |
| 5 | + |
| 6 | +In addition to [managing your secrets within experiences](../../cloud-services/secrets.md), you can manage secrets using the Open Cloud secrets store API. |
| 7 | + |
| 8 | +Before using the API, you must [generate an API key](../auth/api-keys.md) with the `secret-store` API system or [configure your OAuth 2.0 app](../auth/oauth2-overview.md) with the `universe.secret` scope type. The examples on this page use API keys. |
| 9 | + |
| 10 | +## Secret encryption |
| 11 | + |
| 12 | +When creating or updating secrets on Roblox, you must encrypt secrets with a [LibSodium sealed box](https://libsodium.gitbook.io/doc/public-key_cryptography/sealed_boxes) and your experience's public key, and then base64-encode the result. |
| 13 | + |
| 14 | +First, get your experience's public key: |
| 15 | + |
| 16 | +```bash |
| 17 | +curl --location 'https://apis.roblox.com/cloud/v2/universes/{universeId}/secrets/public-key' \ |
| 18 | +--request GET \ |
| 19 | +--header 'x-api-key: <your-secret-here>' \ |
| 20 | +``` |
| 21 | + |
| 22 | +Next, create a sealed box and base64-encode it. The example below uses Python and [PyNaCl](https://pynacl.readthedocs.io/en/latest/public/#nacl-public-sealedbox). (Run `pip install pynacl` to install it locally). |
| 23 | + |
| 24 | +```python |
| 25 | +from base64 import b64encode |
| 26 | +from nacl import encoding, public |
| 27 | + |
| 28 | +public_key = "Zgj4+V7vSaEZ06rXazKJUIcUnVa95tUNiwXAif/vdHo=" |
| 29 | +secret_content = "my_api_key_content" |
| 30 | +public_key = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder()) |
| 31 | +sealed_box = public.SealedBox(public_key) |
| 32 | +encrypted = sealed_box.encrypt(secret_content.encode("utf-8")) |
| 33 | +print(b64encode(encrypted).decode("utf-8")) |
| 34 | +``` |
| 35 | + |
| 36 | +You can then create or update a secret using the output. This example creates a new secret: |
| 37 | + |
| 38 | +```bash |
| 39 | +curl --location 'https://apis.roblox.com/cloud/v2/universes/6930499524/secrets' \ |
| 40 | +--request POST \ |
| 41 | +--header 'Content-Type: application/json' \ |
| 42 | +--header 'x-api-key: <your-secret-here>' \ |
| 43 | +--data '{ |
| 44 | + "id": "mySecret", |
| 45 | + "secret": "fP9scJkcDk492F4c1VHZ5QS8v2qsAg7uI+NVVEw6zC0GBnj7xpi7UrNr++lCfr4wyq3ia9Uuu+Ao8HtIXz2gRxBX", |
| 46 | + "key_id": "1200590785272263122" |
| 47 | +}' |
| 48 | +``` |
| 49 | + |
| 50 | +After you create one, see [Use secrets](../../cloud-services/secrets.md#use-secrets) to use your secret in experience. |
| 51 | + |
| 52 | +## Update secrets |
| 53 | + |
| 54 | +To update the above secret: |
| 55 | + |
| 56 | +```bash |
| 57 | +curl --location 'https://apis.roblox.com/cloud/v2/universes/6930499524/secrets/mySecret' \ |
| 58 | +--request PATCH \ |
| 59 | +--header 'Content-Type: application/json' \ |
| 60 | +--header 'x-api-key: <your-secret-here>' \ |
| 61 | +--data '{ |
| 62 | + "secret": "2Fczw/PL7woOzHnGHQ65sT0MbzJjEOlfibyKxy374CqzFyEb2QTS8grtNBgG/0sfIvSHEo9JWN+pUr0NTPs0V6lj", |
| 63 | + "key_id": "1200590785272263122" |
| 64 | +}' |
| 65 | +``` |
| 66 | + |
| 67 | +If you need to clean up a secret, a deletion request looks like this: |
| 68 | + |
| 69 | +```bash |
| 70 | +curl --location 'https://apis.roblox.com/cloud/v2/universes/6930499524/secrets/mySecret' \ |
| 71 | +--request DELETE \ |
| 72 | +--header 'Content-Type: application/json' \ |
| 73 | +--header 'x-api-key: <your-secret-here>' |
| 74 | +``` |
0 commit comments