Go Headless

Build Apps

Client

API Preview

Develop Websites

REST

Velo

GraphQL (Alpha)

The object including the fields of a new secret to be stored.

secret

Secret

Creates a new secret.

The createSecret() function returns a Promise that resolves to the newly created secret's ID when a secret has been created in the [Secrets Manager](https://support.wix.com/en/article/velo-working-with-the-secrets-manager).
Secrets created by this function are available in the Secrets Manager section in your site's dashboard, just like any other secret created using the UI.

> **Note:** 
> * The secret's name cannot start with `wix` or be identical to an existing secret's name.
>
> * Do not leave private keys in your code! Leaving them in is a security risk. Either delete the keys from the code after running `createSecret()`, or pass the parameters in using the [Functional Testing](https://support.wix.com/en/article/velo-functional-testing-in-the-backend) tool.

import { Permissions, webMethod } from 'wix-web-module';
import wixSecretsBackend from 'wix-secrets-backend';

export const createNewSecret = webMethod(Permissions.Anyone, () => {
  const secret = {
	  name: "s3_secret_key",
	  value: "Fm8OfflH6bJOwWjenqAtLurLbkiMNvmhQHZV+118",
	  description: "AWS secret access key"
  };

  return wixSecretsBackend.createSecret(secret)
    .then((id) => {
      return id;
    })
    .catch((error) => {
      console.error(error);
    });
});

/*
 * Returns a Promise that resolves to:
 *
 * "5ec36ffb-2cec-489a-9c0e-d8f53fef5fd1"
 */

Create a new secret

createSecret

string

Fulfilled - The ID of the created secret.
Rejected - Error message.

Deletes an existing secret by ID.

The `deleteSecret()` function returns a Promise that resolves when a secret from the Secrets Manager is deleted.
You can retrieve the `id` parameter using the [`listSecretInfo()`](#listSecretInfo) function.
Note that the ID used here is the ID retrieved from [`listSecretInfo()`](#listSecretInfo), not the secret name used by [`getSecret()`](#getSecret).

> **Note:** Deleting a secret is irreversible and will break all code using the secret.

import { Permissions, webMethod } from 'wix-web-module';
import wixSecretsBackend from 'wix-secrets-backend';

export const deleteMySecret = webMethod(Permissions.Anyone, () => {
  const id = "b741766c-eead-46fe-8e7f-fd01ff3d6e21";

  return wixSecretsBackend.deleteSecret(id)
    .then(() => {
      console.log("Secret deleted");
    })
    .catch((error) => {
      console.error(error);
    });
});

Delete an existing secret

import { Permissions, webMethod } from 'wix-web-module';
import wixSecretsBackend from 'wix-secrets-backend';

export const deleteFirstSecret = webMethod(Permissions.Anyone, () => {
  return wixSecretsBackend.listSecretInfo()
    .then((secrets) => {
      return wixSecretsBackend.deleteSecret(secrets[0].id);
    })
    .then(() => {
      console.log("Secret deleted");
    })
    .catch((error) => {
      console.error(error);
    });
});

This example demonstrates how to delete the first secret stored in the Secrets Manager. First we retrieve the ID of the secret using the listSecretInfo() function. Then we delete the secret using the retrieved ID.

Retrieve an ID and delete a secret

deleteSecret

void

Fulfilled - When the secret is deleted from the Secrets Manager.
Rejected - Error message.

The name of the secret to get the value of.

name

Gets a secret by name.

The `getSecret()` function returns a Promise that resolves to the value of the secret
 that was stored in the Secrets Manager with the given name.

> **Note:** To prevent malicious users from accessing the value of your secret,
don't return the value of the secret to client side. Only use the secret's value in the backend.

import { Permissions, webMethod } from 'wix-web-module';
import wixSecretsBackend from 'wix-secrets-backend';
import { getJSON } from 'wix-fetch';

export const getSomeJSON = webMethod(Permissions.Anyone, () => {
  return wixSecretsBackend.getSecret("myApiKeyName")
    .then((secret) => {
      return getJSON(`https://someapi.com/api/someendpoint?apiKey=${secret}`);
    })
    .catch((error) => {
      console.error(error);
    });
});

export const getFirstSecretValue = webMethod(Permissions.Anyone, () => {
  return wixSecretsBackend.listSecretInfo()
    .then((secrets) => {
      return wixSecretsBackend.getSecret(secrets[0].name);
    })
    .catch((error) => {
      console.error(error);
    });
});

Get a secret and use it to fetch a JSON from a 3rd-party service


import { Permissions, webMethod } from 'wix-web-module';
import wixSecretsBackend from 'wix-secrets-backend';

export const getFirstSecretValue = webMethod(Permissions.Anyone, () => {
  return wixSecretsBackend.listSecretInfo()
    .then((secrets) => {
      return wixSecretsBackend.getSecret(secrets[0].name);
    })
    .catch((error) => {
      console.error(error);
    });
});

/*
 * Returns a Promise that resolves to:
 *
 * "Fm8OfflH6bJOwWjenqAtLurLbkiMNvmhQHZV+118"
 */


This example demonstrates how to delete the first secret stored in the Secrets Manager. First we retrieve the ID of the secret using the listSecretInfo() function. Then we get the value of the secret using the retrieved ID.

Retrieve a name and get a secret's value

/************************************
 * Backend code - getWeather.web.js *
 ************************************/

import { Permissions, webMethod } from 'wix-web-module';
import wixSecretsBackend from 'wix-secrets-backend';
import { getJSON } from 'wix-fetch';

export const getWeatherJson = webMethod(Permissions.Anyone, async () => {
  const secret = await wixSecretsBackend.getSecret("openWeatherApiKey");
  return getJSON(`https://api.openweathermap.org/data/2.5/weather?q=London&units=metric&APPID=${secret}`);
});

/********************
 * Client-side code *
 ********************/

import { getWeatherJson } from 'backend/getWeather.web';

export async function getWeather_click(event) {
  let json = await getWeatherJson();
  $w("#weather").text = json.weather[0].description; // "mist"
  $w("#temp").text = json.main.temp; // 9.4 (degrees Celsius)
}

In this example, we use the Secrets API to get an API key from the Secrets Manager. We use the key in the backend to fetch a JSON with weather information from a 3rd-party service, and return the JSON to the client side.

Get an API key and use it to fetch a JSON from a weather service

/************************************
 * Backend code - sendEmail.web.js *
 ************************************/

import { Permissions, webMethod } from 'wix-web-module';
import wixSecretsBackend from 'wix-secrets-backend';
import sendGridMail from '@sendgrid/mail';

export const sendEmail = webMethod(Permissions.Anyone, async (recipient, sender, subject, body) => {
  const secret = await wixSecretsBackend.getSecret("SendGridApiKey");
  sendGridMail.setApiKey(secret);
  const message = {
    "to": recipient,
    "from": sender,
    "subject": subject,
    "text": body
  };
  sendGridMail.send(message);
});

/********************
 * Client-side code *
 ********************/

import { sendEmail } from 'backend/sendEmail.web';

export function sendEmailButton_click(event) {
  sendEmail(
    $w("#toEmail").value,
    $w("#fromEmail").value,
    $w("#subject").value,
    $w("#emailContent").value
  )
    .then(() => {
      console.log("Email sent");
    })
    .catch((error) => {
      console.error(error);
    })
}

In this example, we added the SendGrid package to our site using the Package Manager. We created a backend function that gets an API key from the Secrets Manager, sets it as the SendGrid API key, and sends an email using the SendGrid service. We call the function from the client side when a site visitor submits email information via a form.

Get an API key and use it to send an email with the SendGrid npm interface

getSecret

Fulfilled - The value of the secret with the given name.
Rejected - Error message.

Gets a list of objects containing information about all secrets stored in the Secrets Manager.

The `listSecretInfo()` function returns a Promise that resolves to a list containing information about all secrets stored on your site.
The secret's value is omitted for security reasons, and can be retrieved using the [`getSecret()`](wix-secrets-backend.html#getSecret) function for each individual secret.
> **Note:**
> Do not use `listSecretInfo()` in a **.jsw** file with anonymous permissions! This is a serious security risk which exposes your secrets to potential leaks. To prevent this, implement `listSecretInfo()` in a separate **.js** file to block frontend access. If you must include `listSecretInfo()` in a **.jsw** file, make sure the exported function has [permissions set](https://support.wix.com/en/article/velo-about-web-module-permissions) to **Admin**.

import wixSecretsBackend from 'wix-secrets-backend';

export function getSecretInfo() {
  return wixSecretsBackend.listSecretInfo()
  .then((secrets) => {
    return secrets;
  })
  .catch((error) => {
    console.error(error);
  });
}

/* Returns a Promise that resolves to:
 *
 *  [
 *    {
 *      "id": "2eebccce-6c01-469d-a278-433fd96ba111",
 *      "createdDate": "2020-05-26T06:16:46.000Z",
 *      "updatedDate": "2020-05-28T12:21:10.000Z",
 *      "name": "MyFirstSecret",
 *      "description": "This is my first secret"
 *    },
 *    {
 *      "id": "ef4b43d4-851d-4b52-a07f-9a500a888371",
 *      "createdDate": "2020-06-02T08:23:54.000Z",
 *      "updatedDate": "2020-06-02T08:23:54.000Z",
 *      "name": "MySecondSecret",
 *      "description": "This is my second secret"
 *    }
 *  ]
 */

Get information about your secrets

import wixSecretsBackend from 'wix-secrets-backend';

export function getFirstSecretValue() {
  return wixSecretsBackend.listSecretInfo()
    .then((secrets) => {
      return wixSecretsBackend.getSecret(secrets[0].name);
    })
    .catch((error) => {
      console.error(error);
    });
}

/*
 * Returns a Promise that resolves to:
 *
 * "Fm8OfflH6bJOwWjenqAtLurLbkiMNvmhQHZV+118"
 */

import wixSecretsBackend from 'wix-secrets-backend';

export function deleteFirstSecret() {
  return wixSecretsBackend.listSecretInfo()
    .then((secrets) => {
      return wixSecretsBackend.deleteSecret(secrets[0].id);
    })
    .then(() => {
      console.log("Secret deleted");
    })
    .catch((error) => {
      console.error(error);
    });
}

listSecretInfo

SecretInfo

Fulfilled - A list of objects with information about your site secrets.
Rejected - Error message.

The information to update the secret with.

SecretUpdateInfo

Updates the specified fields of an existing secret by ID.

The `updateSecret()` function returns a Promise that resolves when the secret is successfully updated.
You can update one or more secret properties. Only the properties passed in the Secret object will be updated.
All other properties will remain the same.
You can retrieve the `id` parameter from the [`listSecretInfo()`](#listSecretInfo) function.
The `id` is not the same as the secret `name` used by the [`getSecret()`](#getSecret) function.
> **Notes:** 
> + Changing a secret's name or value will break all code using the secret.
>
> + You cannot rename the secret with a name that is already in use.
> + Do not leave private keys in your code! Leaving them in is a security risk. Either delete the keys from the code after running `updateSecret()`, or pass the parameters in using the [Functional Testing](https://support.wix.com/en/article/velo-functional-testing-in-the-backend) tool.

import { Permissions, webMethod } from 'wix-web-module';
import wixSecretsBackend from 'wix-secrets-backend';

export const updateName = webMethod(Permissions.Anyone, () => {
  const id = "b741766c-eead-46fe-8e7f-fd01ff3d6e21";
  const secret = {
    name: "my_new_secret_name"
  };

  return wixSecretsBackend.updateSecret(id, secret)
    .then(() => {
      console.log("Secret name updated");
    })
    .catch((error) => {
      console.error(error);
    })
});

Update a single property of a secret

import { Permissions, webMethod } from 'wix-web-module';
import wixSecretsBackend from 'wix-secrets-backend';

export const updateMultipleProperties = webMethod(Permissions.Anyone, () => {
  const id = "b741766c-eead-46fe-8e7f-fd01ff3d6e21";
  const secret = {
    name: "my_new_secret_name",
    description: "New description",
    value: "new.key.44aSQCljxL9FLvTVA.9dKbpwueYoQ8isyQhvun19pOT9gHEdgxam39LJ0Ts70"
  };

  return wixSecretsBackend.updateSecret(id, secret)
  .then(() => {
    console.log("All secret fields updated");
  })
  .catch((error) => {
    console.error(error);
  });
});

Update multiple properties of a secret

updateSecret

Fulfilled - When the secret is updated.
Rejected - Error message.

# Introduction
Velo's Secrets Manager allows you to securely store API keys and other secrets on your site. 
Each secret's value is encrypted, and assigned a name of your choice and an ID.
You can then use the name or ID to refer to the secret in your backend code rather than hardcoding its value.

Learn more [about Velo's Secrets Manager](https://support.wix.com/en/article/velo-about-the-secrets-manager).

With the Secrets API, you can safely:

- Manage secrets.
- Retrieve secret values.
- Retrieve other information about your secrets, such as their names and descriptions.

 To use the Secrets API, import `wixSecretsBackend` from the `wix-secrets-backend` module:

   ```javascript
   import wixSecretsBackend from 'wix-secrets-backend';
   ```

> Learn more about the Wix Secrets API in [Secrets Manager](/getting-started/integration-with-third-party-services_secrets-manager) in the Velo API Reference, and on [Wix Learn](https://www.wix.com/learn/online-course/coding-with-velo/velo-backend#secure-api-keys).

## Before you begin

It's important to note these points before coding:

- You must set up a [Members Area](https://support.wix.com/en/article/site-members-adding-and-setting-up-a-members-area), before you can create or manage secrets with the Secrets API. 
  The Members Area isn't required to retrieve secrets with [`getSecret()`](https://www.wix.com/velo/reference/wix-secrets-backend/getsecret).
- Deleting a secret, or modifying a secret's name or value, breaks all code using the secret.
- You can't create or rename a secret with a name that's already in use.

**Security considerations**
- If you currently use private keys in your code, we recommend removing them. 
  You can either create a secret with the Secrets API or the [Functional Testing](https://support.wix.com/en/article/velo-functional-testing-in-the-backend) tool.
- To prevent malicious users from accessing the values of your secrets, use them only in backend code. Avoid using secret values in client side code. 

 ## Terminology

- **Secret**: Secrets are values that you don’t want to be publicly accessible, such as login credentials or API keys.
- **API key**: An API (Application Programming Interface) key is a unique code used to authenticate a user or program when making a call to an API.


 
# Sample Flow
 

 
Follow this general procedure for working with API keys or other secrets using the Secrets Manager:
 
1. Get private information such as an API key from a 3rd-party service.
2. Store the private information as a new secret in the [Secrets Manager](https://support.wix.com/en/article/velo-working-with-the-secrets-manager) in your site's dashboard or with the [`createSecret()`](/wix-secrets-backend/createsecret) function. Assign a name to the secret.
3. In your backend code, instead of hardcoding the API key, use the [`getSecret()`](/wix-secrets-backend/getsecret) function with the secret name assigned in the Secrets Manager. When the code runs, the value of the secret is extracted from the Secrets Manager.


velo_wix-secrets-backend

An optional text describing the secret's purpose or any other notes.

description

A unique, meaningful name used for retrieving the secret at runtime using [`getSecret()`](wix-secrets-backend.html#getSecret). You can use alphanumeric characters and the following special characters: `_+=-#@$#`. Spaces are not supported.

The confidential value to protect, such as an API key.

value

The date and time the secret was created.

createdDate

An optional text describing the secret's purpose or any other notes about it.

A unique, meaningful name used for retrieving the secret at runtime using [`getSecret()`](wix-secrets-backend.html#getSecret).

The date and time the secret was last updated.

getSecret( )