---
title: "Update secrets"
---

In this example, we demonstrate how to update secrets

Prerequisites:

- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
- Grasp a basic understanding of the system and its underlying cryptography [here](/api-reference/overview/introduction).

## Flow

1. [Get your (encrypted) private key.](/api-reference/endpoints/users/me)
2. Decrypt your (encrypted) private key with your password.
3. [Get the (encrypted) project key for the project.](/api-reference/endpoints/workspaces/workspace-key)
4. Decrypt the (encrypted) project key with your private key.
5. Encrypt your secret(s) with the project key.
6. [Send (encrypted) updated secret(s) to the Infical API.](/api-reference/endpoints/secrets/update)

## Example

```js
const crypto = require('crypto');
const axios = require('axios');

const ALGORITHM = 'aes-256-gcm';
const BLOCK_SIZE_BYTES = 16;

const encrypt = (
	text,
	secret
) => {
	const iv = crypto.randomBytes(BLOCK_SIZE_BYTES);
	const cipher = crypto.createCipheriv(ALGORITHM, secret, iv);

	let ciphertext = cipher.update(text, 'utf8', 'base64');
	ciphertext += cipher.final('base64');
	return {
		ciphertext,
		iv: iv.toString('base64'),
		tag: cipher.getAuthTag().toString('base64')
	};
}

const decrypt = (ciphertext, iv, tag, secret) => {
	const decipher = crypto.createDecipheriv(
		ALGORITHM,
		secret,
		Buffer.from(iv, 'base64')
	);
	decipher.setAuthTag(Buffer.from(tag, 'base64'));

	let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
	cleartext += decipher.final('utf8');

	return cleartext;
}

const updateSecrets = async () => {
	const API_KEY = 'your_api_key';
	const PSWD = 'your_pswd';
	const WORKSPACE_ID = 'your_workspace_id';

    const SECRET_ID = 'ID' // ID of secret to update
	const SECRET_KEY = 'SOME_KEY';
    const SECRET_VALUE = 'SOME_VALUE';

	// 1. get (encrypted) private key
	const user = await axios.get(
		'https://api.infisical.com/api/v2/users/me', {
			headers: {
				'X-API-KEY': API_KEY
			}
		}
	);

	// 2. decrypt your (encrypted) private key with your password
	const privateKey = decrypt({
		ciphertext: user.encryptedPrivateKey,
		iv: user.iv,
		tag: user.tag,
		secret: PSWD.slice(0, 32).padStart(32, '0');
	});

	// 3. get the (encrypted) project key for the project
	const encryptedProjectKey = await axios.get(
		`https://api.infisical.com/api/v2/workspace/${WORKSPACE_ID}`, {
			headers: {
				'X-API-KEY': API_KEY
			}
		}
	);

	// 4. decrypt the project key with your private key
	const projectKey = nacl.box.open(
		util.decodeBase64(encryptedProjectKey),
		util.decodeBase64(projectKey.nonce),
		util.decodeBase64(projectKey.sender.publicKey),
		util.decodeBase64(privateKey)
	);

	// 5. encrypt your secret(s) with the project key
	const {
		ciphertext: secretKeyCiphertext,
		iv: secretKeyIV,
		tag: secretKeyTag
	} = encrypt(SECRET_KEY, projectKey);

	const {
		ciphertext: secretValueCiphertext,
		iv: secretValueIV,
		tag: secretValueTag
	} = encrypt(SECRET_VALUE, projectKey);

	const secret = {
        id: SECRET_ID,
		secretKeyCiphertext,
		secretKeyIV,
		secretKeyTag,
		secretValueCiphertext,
		secretValueIV,
		secretValueTag
	}

	// 6. Send (encrypted) secret(s) to the Infisical API
	await axios.patch(
		`https://api.infisical.com/api/v2/secrets`,
		{
			secrets: secret
		},
		{
			headers: {
				'X-API-KEY': API_KEY
			}
		}
	);
}

updateSecrets();
```

<Info>
  This example uses [TweetNaCl.js](https://tweetnacl.js.org/#/), a port of
  TweetNacl/Nacl, to perform asymmeric decryption of the project key but there
  are ports of NaCl available in every major language.
</Info>
<Tip>
  It can be useful to perform steps 1-4 ahead of time and store away your
  private key (and even project key) for later use. The Infisical CLI works by
  securely storing your private key via your OS keyring.
</Tip>