---
title: "Retrieve secret"
description: "How to get a secret using an Infisical Token scoped to a project and environment"
---

Prerequisites:

- Set up and add envars to [Infisical Cloud](https://app.infisical.com).
- Create an [Infisical Token](../../../getting-started/dashboard/token) for your project and environment.
- Grasp a basic understanding of the system and its underlying cryptography [here](/api-reference/overview/introduction).
- [Ensure that your project is blind-indexed](../blind-indices).

## Flow

1. [Get your Infisical Token data](/api-reference/endpoints/service-tokens/get) including a (encrypted) project key.
2. [Get the secret from your project and environment](/api-reference/endpoints/secrets/read-one).
3. Decrypt the (encrypted) project key with the key from your Infisical Token.
4. Decrypt the (encrypted) secret

## Example

<Tabs>
  <Tab title="Javascript">
```js
const crypto = require('crypto');
const axios = require('axios');

const BASE_URL = 'https://app.infisical.com';
const ALGORITHM = 'aes-256-gcm';

const decrypt = ({ ciphertext, iv, tag, secret}) => {
	const decipher = crypto.createDecipheriv(
		ALGORITHM,
		secret,
		Buffer.from(iv, 'base64')
	);
	decipher.setAuthTag(Buffer.from(tag, 'base64'));

    let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
    cleartext += decipher.final('utf8');

    return cleartext;
}

const getSecret = async () => {
	const serviceToken = 'your_service_token';
	const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);
    
    const secretType = 'shared' // 'shared' or 'personal'
    const secretKey = 'some_key';

    // 1. Get your Infisical Token data
    const { data: serviceTokenData } = await axios.get(
       `${BASE_URL}/api/v2/service-token`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    // 2. Get the secret from your project and environment
    const { data } = await axios.get(
       `${BASE_URL}/api/v3/secrets/${secretKey}?${new URLSearchParams({
            environment: serviceTokenData.environment,
            workspaceId: serviceTokenData.workspace,
            type: secretType // optional, defaults to 'shared'
        })}`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    const encryptedSecret = data.secret;

    // 3. Decrypt the (encrypted) project key with the key from your Infisical Token
    const projectKey = decrypt({
        ciphertext: serviceTokenData.encryptedKey,
        iv: serviceTokenData.iv,
        tag: serviceTokenData.tag,
        secret: serviceTokenSecret
    });

	// 4. Decrypt the (encrypted) secret value

    const secretValue = decrypt({
        ciphertext: encryptedSecret.secretValueCiphertext,
        iv: encryptedSecret.secretValueIV,
        tag: encryptedSecret.secretValueTag,
        secret: projectKey
    });

    console.log('secret: ', ({
        secretKey,
        secretValue
    }));
}

getSecret();

```
  </Tab>

<Tab title="Python">
```Python
import requests
import base64
from Cryptodome.Cipher import AES


BASE_URL = "http://app.infisical.com"


def decrypt(ciphertext, iv, tag, secret):
    secret = bytes(secret, "utf-8")
    iv = base64.standard_b64decode(iv)
    tag = base64.standard_b64decode(tag)
    ciphertext = base64.standard_b64decode(ciphertext)

    cipher = AES.new(secret, AES.MODE_GCM, iv)
    cipher.update(tag)
    cleartext = cipher.decrypt(ciphertext).decode("utf-8")
    return cleartext


def get_secret():
    service_token = "your_service_token"
    service_token_secret = service_token[service_token.rindex(".") + 1 :]

    secret_type = "shared" # "shared" or "personal"
    secret_key = "some_key"

    # 1. Get your Infisical Token data
    service_token_data = requests.get(
        f"{BASE_URL}/api/v2/service-token",
        headers={"Authorization": f"Bearer {service_token}"},
    ).json()

    # 2. Get secret from your project and environment
    data = requests.get(
        f"{BASE_URL}/api/v3/secrets/{secret_key}",
        params={
            "environment": service_token_data["environment"],
            "workspaceId": service_token_data["workspace"],
            "type": secret_type # optional, defaults to "shared"
        },
        headers={"Authorization": f"Bearer {service_token}"},
    ).json()

    encrypted_secret = data["secret"]

    # 3. Decrypt the (encrypted) project key with the key from your Infisical Token
    project_key = decrypt(
        ciphertext=service_token_data["encryptedKey"],
        iv=service_token_data["iv"],
        tag=service_token_data["tag"],
        secret=service_token_secret,
    )

    # 4. Decrypt the (encrypted) secret value
    secret_value = decrypt(
        ciphertext=encrypted_secret["secretValueCiphertext"],
        iv=encrypted_secret["secretValueIV"],
        tag=encrypted_secret["secretValueTag"],
        secret=project_key,
    )

    print("secret: ", {
        "secret_key": secret_key,
        "secret_value": secret_value
    })


get_secret()

```
</Tab>
</Tabs>