infisical/docs/api-reference/overview/examples/retrieve-secrets.mdx

---
title: "Retrieve secrets"
---

In this example, we demonstrate how to retrieve secrets from a project and environment using an Infisical Token.

Prerequisites:

- Set up and add envars to [Infisical Cloud](https://app.infisical.com).
- Create an [Infisical Token](../../../getting-started/dashboard/token) for your project and environment.
- Grasp a basic understanding of the system and its underlying cryptography [here](/api-reference/overview/introduction).

## Flow

1. [Get your Infisical Token data](/api-reference/endpoints/service-tokens/get) including a (encrypted) project key.
2. [Get secrets for your project and environment](/api-reference/endpoints/secrets/read).
3. Decrypt the (encrypted) project key with the key from your Infisical Token.
4. Decrypt the (encrypted) secrets

## Example

<Tabs>
  <Tab title="Javascript">
```js
const crypto = require('crypto');
const axios = require('axios');

const BASE_URL = 'https://app.infisical.com';
const ALGORITHM = 'aes-256-gcm';

const decrypt = ({ ciphertext, iv, tag, secret}) => {
	const decipher = crypto.createDecipheriv(
		ALGORITHM,
		secret,
		Buffer.from(iv, 'base64')
	);
	decipher.setAuthTag(Buffer.from(tag, 'base64'));

    let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
    cleartext += decipher.final('utf8');

    return cleartext;
}

const getSecrets = async () => {
	const serviceToken = 'your_service_token';
	const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);

    // 1. Get your Infisical Token data
    const { data: serviceTokenData } = await axios.get(
       `${BASE_URL}/api/v2/service-token`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    // 2. Get secrets for your project and environment
    const { data } = await axios.get(
       `${BASE_URL}/api/v2/secrets?${new URLSearchParams({
            environment: serviceTokenData.environment,
            workspaceId: serviceTokenData.workspace
        })}`,
        {
            headers: {
                Authorization: `Bearer ${serviceToken}`
            }
        }
    );

    const encryptedSecrets = data.secrets;

    // 3. Decrypt the (encrypted) project key with the key from your Infisical Token
    const projectKey = decrypt({
        ciphertext: serviceTokenData.encryptedKey,
        iv: serviceTokenData.iv,
        tag: serviceTokenData.tag,
        secret: serviceTokenSecret
    });

	// 4. Decrypt the (encrypted) secrets
    const secrets = encryptedSecrets.map((secret) => {
        const secretKey = decrypt({
          ciphertext: secret.secretKeyCiphertext,
          iv: secret.secretKeyIV,
          tag: secret.secretKeyTag,
          secret: projectKey
        });

        const secretValue = decrypt({
          ciphertext: secret.secretValueCiphertext,
          iv: secret.secretValueIV,
          tag: secret.secretValueTag,
          secret: projectKey
        });

        return ({
            secretKey,
            secretValue
        });
    });

    console.log('secrets: ', secrets);
}

getSecrets();

```
  </Tab>
</Tabs>

<Info>
  This example uses [TweetNaCl.js](https://tweetnacl.js.org/#/), a port of
  TweetNacl/Nacl, to perform asymmeric decryption of the project key but there
  are ports of NaCl available in every major language.
</Info>