> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Delete secret

> <Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Deletes one secret from the app.

Deleting a secret redeploys the app's backend functions so they stop receiving it. A function that still reads the name gets no value for it, so remove or update that code too.

Deleting is permanent. To use the secret again, set it anew with [Set secret](/api-reference/set-secret).

<Note>This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted.</Note>



## OpenAPI

````yaml /developers/references/app-management/app-management-openapi.json delete /api/apps/{app_id}/secrets
openapi: 3.1.0
info:
  title: Base44 App Management API
  version: 1.0.0
servers:
  - url: https://app.base44.com
security:
  - PersonalAccessTokenAuth: []
paths:
  /api/apps/{app_id}/secrets:
    delete:
      summary: Delete secret
      description: >-
        <Info>This API is in beta. Endpoints, fields, and behavior may still
        change, so avoid depending on it in production.</Info>


        Deletes one secret from the app.


        Deleting a secret redeploys the app's backend functions so they stop
        receiving it. A function that still reads the name gets no value for it,
        so remove or update that code too.


        Deleting is permanent. To use the secret again, set it anew with [Set
        secret](/api-reference/set-secret).


        <Note>This endpoint accepts a personal API key belonging to a user with
        editor access to the app. A read-only key is refused, and workspace API
        keys are not accepted.</Note>
      operationId: delete_secret_api_api_apps__app_id__secrets_delete
      parameters:
        - name: app_id
          in: path
          required: true
          schema:
            type: string
            description: ID of the app to delete the secret from.
            title: App Id
          description: ID of the app to delete the secret from.
          example: 6820f3a4e7b91d003c45a1f2
        - name: secret_name
          in: query
          required: true
          schema:
            type: string
            description: >-
              Name of the secret to delete, as returned by [List
              secrets](/api-reference/list-secrets).
            title: Secret Name
          description: >-
            Name of the secret to delete, as returned by [List
            secrets](/api-reference/list-secrets).
          example: STRIPE_SECRET_KEY
      responses:
        '200':
          description: The secret was deleted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteSecretResponse'
        '401':
          description: Missing or invalid credentials.
        '403':
          description: >-
            You don't have editor access to this app, or your API key is
            read-only.
        '404':
          description: App not found, or the app has no secret with this name.
        '422':
          description: '`secret_name` is missing.'
      security:
        - PersonalAccessTokenAuth:
            - full_access
components:
  schemas:
    DeleteSecretResponse:
      properties:
        success:
          type: boolean
          title: Success
          description: >-
            Always `true`. A delete that doesn't happen returns an error
            instead.
          example: true
      type: object
      required:
        - success
      title: DeleteSecretResponse
      description: Confirmation that the secret was deleted.
  securitySchemes:
    PersonalAccessTokenAuth:
      type: http
      scheme: bearer
      description: >-
        Personal access token, sent as `Authorization: Bearer <token>`. Each
        operation lists the permission it needs: `read_only` or `full_access`. A
        full-access token can call every operation. A read-only token can call
        only the operations that list `read_only`; anything else returns 403
        `read_only_credential_route_not_allowed`.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.