---
title: "E2EE Enabled"
---

<Note>
    E2EE enabled mode only works with [Service Tokens](/documentation/platform/token) and cannot be used with [Identities](/documentation/platform/identities/overview).
</Note>

Using Infisical's API to read/write secrets with E2EE enabled allows you to create, update, and retrieve secrets
but requires you to perform client-side encryption/decryption operations. For this reason, we recommend using one of the available
SDKs instead.

<AccordionGroup>
    <Accordion title="Retrieve secrets">
        <Tabs>
  <Tab title="Javascript">
   Retrieve all secrets for an Infisical project and environment.
```js
const crypto = require('crypto');
const axios = require('axios');

const BASE_URL = 'https://app.infisical.com';
const ALGORITHM = 'aes-256-gcm';

const decrypt = ({ ciphertext, iv, tag, secret}) => {
	const decipher = crypto.createDecipheriv(
		ALGORITHM,
		secret,
		Buffer.from(iv, 'base64')
	);
	decipher.setAuthTag(Buffer.from(tag, 'base64'));

    let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
    cleartext += decipher.final('utf8');

    return cleartext;
}

const getSecrets = async () => {
	const serviceToken = 'your_service_token';
	const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);

    // 1. Get your Infisical Token data
    const { data: serviceTokenData } = await axios.get(
       `${BASE_URL}/api/v2/service-token`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    // 2. Get secrets for your project and environment
    const { data } = await axios.get(
       `${BASE_URL}/api/v3/secrets?${new URLSearchParams({
            environment: serviceTokenData.environment,
            workspaceId: serviceTokenData.workspace
        })}`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    const encryptedSecrets = data.secrets;

    // 3. Decrypt the (encrypted) project key with the key from your Infisical Token
    const projectKey = decrypt({
        ciphertext: serviceTokenData.encryptedKey,
        iv: serviceTokenData.iv,
        tag: serviceTokenData.tag,
        secret: serviceTokenSecret
    });

	// 4. Decrypt the (encrypted) secrets
    const secrets = encryptedSecrets.map((secret) => {
        const secretKey = decrypt({
          ciphertext: secret.secretKeyCiphertext,
          iv: secret.secretKeyIV,
          tag: secret.secretKeyTag,
          secret: projectKey
        });

        const secretValue = decrypt({
          ciphertext: secret.secretValueCiphertext,
          iv: secret.secretValueIV,
          tag: secret.secretValueTag,
          secret: projectKey
        });

        return ({
            secretKey,
            secretValue
        });
    });

    console.log('secrets: ', secrets);
}

getSecrets();

```
  </Tab>

<Tab title="Python">
```Python
import requests
import base64
from Cryptodome.Cipher import AES


BASE_URL = "http://app.infisical.com"


def decrypt(ciphertext, iv, tag, secret):
    secret = bytes(secret, "utf-8")
    iv = base64.standard_b64decode(iv)
    tag = base64.standard_b64decode(tag)
    ciphertext = base64.standard_b64decode(ciphertext)

    cipher = AES.new(secret, AES.MODE_GCM, iv)
    cipher.update(tag)
    cleartext = cipher.decrypt(ciphertext).decode("utf-8")
    return cleartext


def get_secrets():
    service_token = "your_service_token"
    service_token_secret = service_token[service_token.rindex(".") + 1 :]

    # 1. Get your Infisical Token data
    service_token_data = requests.get(
        f"{BASE_URL}/api/v2/service-token",
        headers={"Authorization": f"Bearer {service_token}"},
    ).json()

    # 2. Get secrets for your project and environment
    data = requests.get(
        f"{BASE_URL}/api/v3/secrets",
        params={
            "environment": service_token_data["environment"],
            "workspaceId": service_token_data["workspace"],
        },
        headers={"Authorization": f"Bearer {service_token}"},
    ).json()

    encrypted_secrets = data["secrets"]

    # 3. Decrypt the (encrypted) project key with the key from your Infisical Token
    project_key = decrypt(
        ciphertext=service_token_data["encryptedKey"],
        iv=service_token_data["iv"],
        tag=service_token_data["tag"],
        secret=service_token_secret,
    )

    # 4. Decrypt the (encrypted) secrets
    secrets = []
    for secret in encrypted_secrets:
        secret_key = decrypt(
            ciphertext=secret["secretKeyCiphertext"],
            iv=secret["secretKeyIV"],
            tag=secret["secretKeyTag"],
            secret=project_key,
        )

        secret_value = decrypt(
            ciphertext=secret["secretValueCiphertext"],
            iv=secret["secretValueIV"],
            tag=secret["secretValueTag"],
            secret=project_key,
        )

        secrets.append(
            {
                "secret_key": secret_key,
                "secret_value": secret_value,
            }
        )

    print("secrets:", secrets)


get_secrets()

```
</Tab>
</Tabs>
    </Accordion>
    <Accordion title="Create secret">
        <Tabs>
<Tab title="Javascript">
Create a secret in Infisical.
```js
const crypto = require('crypto');
const axios = require('axios');
const nacl = require('tweetnacl');

const BASE_URL = 'https://app.infisical.com';
const ALGORITHM = 'aes-256-gcm';
const BLOCK_SIZE_BYTES = 16;

const encrypt = ({ text, secret }) => {
    const iv = crypto.randomBytes(BLOCK_SIZE_BYTES);
    const cipher = crypto.createCipheriv(ALGORITHM, secret, iv);

    let ciphertext = cipher.update(text, 'utf8', 'base64');
    ciphertext += cipher.final('base64');
    return {
        ciphertext,
        iv: iv.toString('base64'),
        tag: cipher.getAuthTag().toString('base64')
    };
}

const decrypt = ({ ciphertext, iv, tag, secret}) => {
	const decipher = crypto.createDecipheriv(
		ALGORITHM,
		secret,
		Buffer.from(iv, 'base64')
	);
	decipher.setAuthTag(Buffer.from(tag, 'base64'));

	let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
	cleartext += decipher.final('utf8');

	return cleartext;
}

const createSecrets = async () => {
    const serviceToken = '';
    const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);
    
    const secretType = 'shared'; // 'shared' or 'personal'
    const secretKey = 'some_key';
    const secretValue = 'some_value';
    const secretComment = 'some_comment';

    // 1. Get your Infisical Token data
    const { data: serviceTokenData } = await axios.get(
       `${BASE_URL}/api/v2/service-token`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    // 2. Decrypt the (encrypted) project key with the key from your Infisical Token
    const projectKey = decrypt({
        ciphertext: serviceTokenData.encryptedKey,
        iv: serviceTokenData.iv,
        tag: serviceTokenData.tag,
        secret: serviceTokenSecret
    });
    
	// 3. Encrypt your secret with the project key
    const {
        ciphertext: secretKeyCiphertext,
        iv: secretKeyIV,
        tag: secretKeyTag
    } = encrypt({
        text: secretKey,
        secret: projectKey
    });

    const {
        ciphertext: secretValueCiphertext,
        iv: secretValueIV,
        tag: secretValueTag
    } = encrypt({
        text: secretValue,
        secret: projectKey
    });

    const {
        ciphertext: secretCommentCiphertext,
        iv: secretCommentIV,
        tag: secretCommentTag
    } = encrypt({
        text: secretComment,
        secret: projectKey
    });

	// 4. Send (encrypted) secret to Infisical
    await axios.post(
        `${BASE_URL}/api/v3/secrets/${secretKey}`,
        {
            workspaceId: serviceTokenData.workspace,
            environment: serviceTokenData.environment,
            type: secretType,
            secretKeyCiphertext,
            secretKeyIV,
            secretKeyTag,
            secretValueCiphertext,
            secretValueIV,
            secretValueTag,
            secretCommentCiphertext,
            secretCommentIV,
            secretCommentTag
        },
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );
}

createSecrets();
```
</Tab>

<Tab title="Python">
```Python
import base64
import requests
from Cryptodome.Cipher import AES
from Cryptodome.Random import get_random_bytes


BASE_URL = "https://app.infisical.com"
BLOCK_SIZE_BYTES = 16


def encrypt(text, secret):
    iv = get_random_bytes(BLOCK_SIZE_BYTES)
    secret = bytes(secret, "utf-8")
    cipher = AES.new(secret, AES.MODE_GCM, iv)
    ciphertext, tag = cipher.encrypt_and_digest(text.encode("utf-8"))
    return {
        "ciphertext": base64.standard_b64encode(ciphertext).decode("utf-8"),
        "tag": base64.standard_b64encode(tag).decode("utf-8"),
        "iv": base64.standard_b64encode(iv).decode("utf-8"),
    }


def decrypt(ciphertext, iv, tag, secret):
    secret = bytes(secret, "utf-8")
    iv = base64.standard_b64decode(iv)
    tag = base64.standard_b64decode(tag)
    ciphertext = base64.standard_b64decode(ciphertext)

    cipher = AES.new(secret, AES.MODE_GCM, iv)
    cipher.update(tag)
    cleartext = cipher.decrypt(ciphertext).decode("utf-8")
    return cleartext


def create_secrets():
    service_token = "your_service_token"
    service_token_secret = service_token[service_token.rindex(".") + 1 :]

    secret_type = "shared"  # "shared or "personal"
    secret_key = "some_key"
    secret_value = "some_value"
    secret_comment = "some_comment"

    # 1. Get your Infisical Token data
    service_token_data = requests.get(
        f"{BASE_URL}/api/v2/service-token",
        headers={"Authorization": f"Bearer {service_token}"},
    ).json()

    # 2. Decrypt the (encrypted) project key with the key from your Infisical Token
    project_key = decrypt(
        ciphertext=service_token_data["encryptedKey"],
        iv=service_token_data["iv"],
        tag=service_token_data["tag"],
        secret=service_token_secret,
    )

    # 3. Encrypt your secret with the project key
    encrypted_key_data = encrypt(text=secret_key, secret=project_key)
    encrypted_value_data = encrypt(text=secret_value, secret=project_key)
    encrypted_comment_data = encrypt(text=secret_comment, secret=project_key)

    # 4. Send (encrypted) secret to Infisical
    requests.post(
        f"{BASE_URL}/api/v3/secrets/{secret_key}",
        json={
            "workspaceId": service_token_data["workspace"],
            "environment": service_token_data["environment"],
            "type": secret_type,
            "secretKeyCiphertext": encrypted_key_data["ciphertext"],
            "secretKeyIV": encrypted_key_data["iv"],
            "secretKeyTag": encrypted_key_data["tag"],
            "secretValueCiphertext": encrypted_value_data["ciphertext"],
            "secretValueIV": encrypted_value_data["iv"],
            "secretValueTag": encrypted_value_data["tag"],
            "secretCommentCiphertext": encrypted_comment_data["ciphertext"],
            "secretCommentIV": encrypted_comment_data["iv"],
            "secretCommentTag": encrypted_comment_data["tag"]
        },
        headers={"Authorization": f"Bearer {service_token}"},
    )


create_secrets()

```
</Tab>
</Tabs>
    </Accordion>
    <Accordion title="Retrieve secret">
        <Tabs>
  <Tab title="Javascript">
  Retrieve a secret from Infisical.
```js
const crypto = require('crypto');
const axios = require('axios');

const BASE_URL = 'https://app.infisical.com';
const ALGORITHM = 'aes-256-gcm';

const decrypt = ({ ciphertext, iv, tag, secret}) => {
	const decipher = crypto.createDecipheriv(
		ALGORITHM,
		secret,
		Buffer.from(iv, 'base64')
	);
	decipher.setAuthTag(Buffer.from(tag, 'base64'));

    let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
    cleartext += decipher.final('utf8');

    return cleartext;
}

const getSecret = async () => {
	const serviceToken = 'your_service_token';
	const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);
    
    const secretType = 'shared' // 'shared' or 'personal'
    const secretKey = 'some_key';

    // 1. Get your Infisical Token data
    const { data: serviceTokenData } = await axios.get(
       `${BASE_URL}/api/v2/service-token`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    // 2. Get the secret from your project and environment
    const { data } = await axios.get(
       `${BASE_URL}/api/v3/secrets/${secretKey}?${new URLSearchParams({
            environment: serviceTokenData.environment,
            workspaceId: serviceTokenData.workspace,
            type: secretType // optional, defaults to 'shared'
        })}`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    const encryptedSecret = data.secret;

    // 3. Decrypt the (encrypted) project key with the key from your Infisical Token
    const projectKey = decrypt({
        ciphertext: serviceTokenData.encryptedKey,
        iv: serviceTokenData.iv,
        tag: serviceTokenData.tag,
        secret: serviceTokenSecret
    });

	// 4. Decrypt the (encrypted) secret value

    const secretValue = decrypt({
        ciphertext: encryptedSecret.secretValueCiphertext,
        iv: encryptedSecret.secretValueIV,
        tag: encryptedSecret.secretValueTag,
        secret: projectKey
    });

    console.log('secret: ', ({
        secretKey,
        secretValue
    }));
}

getSecret();

```
  </Tab>

<Tab title="Python">
```Python
import requests
import base64
from Cryptodome.Cipher import AES


BASE_URL = "http://app.infisical.com"


def decrypt(ciphertext, iv, tag, secret):
    secret = bytes(secret, "utf-8")
    iv = base64.standard_b64decode(iv)
    tag = base64.standard_b64decode(tag)
    ciphertext = base64.standard_b64decode(ciphertext)

    cipher = AES.new(secret, AES.MODE_GCM, iv)
    cipher.update(tag)
    cleartext = cipher.decrypt(ciphertext).decode("utf-8")
    return cleartext


def get_secret():
    service_token = "your_service_token"
    service_token_secret = service_token[service_token.rindex(".") + 1 :]

    secret_type = "shared" # "shared" or "personal"
    secret_key = "some_key"

    # 1. Get your Infisical Token data
    service_token_data = requests.get(
        f"{BASE_URL}/api/v2/service-token",
        headers={"Authorization": f"Bearer {service_token}"},
    ).json()

    # 2. Get secret from your project and environment
    data = requests.get(
        f"{BASE_URL}/api/v3/secrets/{secret_key}",
        params={
            "environment": service_token_data["environment"],
            "workspaceId": service_token_data["workspace"],
            "type": secret_type # optional, defaults to "shared"
        },
        headers={"Authorization": f"Bearer {service_token}"},
    ).json()

    encrypted_secret = data["secret"]

    # 3. Decrypt the (encrypted) project key with the key from your Infisical Token
    project_key = decrypt(
        ciphertext=service_token_data["encryptedKey"],
        iv=service_token_data["iv"],
        tag=service_token_data["tag"],
        secret=service_token_secret,
    )

    # 4. Decrypt the (encrypted) secret value
    secret_value = decrypt(
        ciphertext=encrypted_secret["secretValueCiphertext"],
        iv=encrypted_secret["secretValueIV"],
        tag=encrypted_secret["secretValueTag"],
        secret=project_key,
    )

    print("secret: ", {
        "secret_key": secret_key,
        "secret_value": secret_value
    })


get_secret()

```
</Tab>
</Tabs>
    </Accordion>
    <Accordion title="Update secret">
        <Tabs>
<Tab title="Javascript">
Update an existing secret in Infisical.
```js
const crypto = require('crypto');
const axios = require('axios');

const BASE_URL = 'https://app.infisical.com';
const ALGORITHM = 'aes-256-gcm';
const BLOCK_SIZE_BYTES = 16;

const encrypt = ({ text, secret }) => {
    const iv = crypto.randomBytes(BLOCK_SIZE_BYTES);
    const cipher = crypto.createCipheriv(ALGORITHM, secret, iv);

    let ciphertext = cipher.update(text, 'utf8', 'base64');
    ciphertext += cipher.final('base64');
    return {
        ciphertext,
        iv: iv.toString('base64'),
        tag: cipher.getAuthTag().toString('base64')
    };
}

const decrypt = ({ ciphertext, iv, tag, secret}) => {
	const decipher = crypto.createDecipheriv(
		ALGORITHM,
		secret,
		Buffer.from(iv, 'base64')
	);
	decipher.setAuthTag(Buffer.from(tag, 'base64'));

	let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
	cleartext += decipher.final('utf8');

	return cleartext;
}

const updateSecrets = async () => {
    const serviceToken = 'your_service_token';
    const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);
    
    const secretType = 'shared' // 'shared' or 'personal'
    const secretKey = 'some_key';
    const secretValue = 'updated_value';
    const secretComment = 'updated_comment';

    // 1. Get your Infisical Token data
    const { data: serviceTokenData } = await axios.get(
       `${BASE_URL}/api/v2/service-token`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    // 2. Decrypt the (encrypted) project key with the key from your Infisical Token
    const projectKey = decrypt({
        ciphertext: serviceTokenData.encryptedKey,
        iv: serviceTokenData.iv,
        tag: serviceTokenData.tag,
        secret: serviceTokenSecret
    });
    
	// 3. Encrypt your updated secret with the project key
    const {
        ciphertext: secretKeyCiphertext,
        iv: secretKeyIV,
        tag: secretKeyTag
    } = encrypt({
        text: secretKey,
        secret: projectKey
    });

    const {
        ciphertext: secretValueCiphertext,
        iv: secretValueIV,
        tag: secretValueTag
    } = encrypt({
        text: secretValue,
        secret: projectKey
    });

    const {
        ciphertext: secretCommentCiphertext,
        iv: secretCommentIV,
        tag: secretCommentTag
    } = encrypt({
        text: secretComment,
        secret: projectKey
    });
	
	// 4. Send (encrypted) updated secret to Infisical
    await axios.patch(
        `${BASE_URL}/api/v3/secrets/${secretKey}`,
        {
            workspaceId: serviceTokenData.workspace,
            environment: serviceTokenData.environment,
            type: secretType,
            secretValueCiphertext,
            secretValueIV,
            secretValueTag,
            secretCommentCiphertext,
            secretCommentIV,
            secretCommentTag
        },
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );
}

updateSecrets();
```
</Tab>

<Tab title="Python">
```Python
import base64
import requests
from Cryptodome.Cipher import AES
from Cryptodome.Random import get_random_bytes


BASE_URL = "https://app.infisical.com"
BLOCK_SIZE_BYTES = 16


def encrypt(text, secret):
    iv = get_random_bytes(BLOCK_SIZE_BYTES)
    secret = bytes(secret, "utf-8")
    cipher = AES.new(secret, AES.MODE_GCM, iv)
    ciphertext, tag = cipher.encrypt_and_digest(text.encode("utf-8"))
    return {
        "ciphertext": base64.standard_b64encode(ciphertext).decode("utf-8"),
        "tag": base64.standard_b64encode(tag).decode("utf-8"),
        "iv": base64.standard_b64encode(iv).decode("utf-8"),
    }


def decrypt(ciphertext, iv, tag, secret):
    secret = bytes(secret, "utf-8")
    iv = base64.standard_b64decode(iv)
    tag = base64.standard_b64decode(tag)
    ciphertext = base64.standard_b64decode(ciphertext)

    cipher = AES.new(secret, AES.MODE_GCM, iv)
    cipher.update(tag)
    cleartext = cipher.decrypt(ciphertext).decode("utf-8")
    return cleartext


def update_secret():
    service_token = "your_service_token"
    service_token_secret = service_token[service_token.rindex(".") + 1 :]

    secret_type = "shared" # "shared" or "personal"
    secret_key = "some_key"
    secret_value = "updated_value"
    secret_comment = "updated_comment"

    # 1. Get your Infisical Token data
    service_token_data = requests.get(
        f"{BASE_URL}/api/v2/service-token",
        headers={"Authorization": f"Bearer {service_token}"},
    ).json()

    # 2. Decrypt the (encrypted) project key with the key from your Infisical Token
    project_key = decrypt(
        ciphertext=service_token_data["encryptedKey"],
        iv=service_token_data["iv"],
        tag=service_token_data["tag"],
        secret=service_token_secret,
    )

    # 3. Encrypt your updated secret with the project key
    encrypted_key_data = encrypt(text=secret_key, secret=project_key)
    encrypted_value_data = encrypt(text=secret_value, secret=project_key)
    encrypted_comment_data = encrypt(text=secret_comment, secret=project_key)

    # 4. Send (encrypted) updated secret to Infisical
    requests.patch(
        f"{BASE_URL}/api/v3/secrets/{secret_key}",
        json={
            "workspaceId": service_token_data["workspace"],
            "environment": service_token_data["environment"],
            "type": secret_type,
            "secretKeyCiphertext": encrypted_key_data["ciphertext"],
            "secretKeyIV": encrypted_key_data["iv"],
            "secretKeyTag": encrypted_key_data["tag"],
            "secretValueCiphertext": encrypted_value_data["ciphertext"],
            "secretValueIV": encrypted_value_data["iv"],
            "secretValueTag": encrypted_value_data["tag"],
            "secretCommentCiphertext": encrypted_comment_data["ciphertext"],
            "secretCommentIV": encrypted_comment_data["iv"],
            "secretCommentTag": encrypted_comment_data["tag"]
        },
        headers={"Authorization": f"Bearer {service_token}"},
    )


update_secret()

```
</Tab>
</Tabs>
    </Accordion>
    <Accordion title="Delete secret">
        <Tabs>
  <Tab title="Javascript">
  Delete a secret in Infisical.
```js
const axios = require('axios'); 
const BASE_URL = 'https://app.infisical.com';

const deleteSecrets = async () => {
  const serviceToken = 'your_service_token';
  const secretType = 'shared' // 'shared' or 'personal'
  const secretKey = 'some_key'
  
  // 1. Get your Infisical Token data
  const { data: serviceTokenData } = await axios.get(
      `${BASE_URL}/api/v2/service-token`,
      {
          headers: {
              Authorization: `Bearer ${serviceToken}`
          }
      }
  );

  // 2. Delete secret from Infisical
  await axios.delete(
    `${BASE_URL}/api/v3/secrets/${secretKey}`,
    {
      workspaceId: serviceTokenData.workspace,
      environment: serviceTokenData.environment,
      type: secretType
    },
    {
      headers: {
        Authorization: `Bearer ${serviceToken}`
      },
    }
  );
};

deleteSecrets();
```
  </Tab>

  <Tab title="Python">
```Python
import requests

BASE_URL = "https://app.infisical.com"


def delete_secrets():
    service_token = "<your_service_token>"
    secret_type = "shared" # "shared" or "personal"
    secret_key = "some_key"

    # 1. Get your Infisical Token data
    service_token_data = requests.get(
        f"{BASE_URL}/api/v2/service-token",
        headers={"Authorization": f"Bearer {service_token}"},
    ).json() 

    # 2. Delete secret from Infisical
    requests.delete(
        f"{BASE_URL}/api/v2/secrets/{secret_key}",
        json={
            "workspaceId": service_token_data["workspace"],
            "environment": service_token_data["environment"],
            "type": secret_type
        },
        headers={"Authorization": f"Bearer {service_token}"},
    )


delete_secrets()

```
  </Tab>
</Tabs>
<Info>
  If using an `API_KEY` to authenticate with the Infisical API, then you should include it in the `X_API_KEY` header.
</Info>

    </Accordion>
</AccordionGroup>