---
title: "Update Secret"
method: PATCH
path: "/cloud/v2/universes/{universeId}/secrets/{secretId}"
tags: ["Universes"]
---

# Update Secret

`PATCH /cloud/v2/universes/{universeId}/secrets/{secretId}`

Updates an existing secret.

Only the owner of the universe can update secrets. For group-owned universes, only the group owner or authorized
members can update secrets.

Only the secret content, key_id, and domain can be updated - the secret ID cannot be changed.

To encrypt the updated secret:
1. Get the current public key using the GetPublicKey endpoint
2. Encrypt your new secret content using LibSodium sealed box
3. Base64 encode the encrypted content

Include the key_id from the public key response in the request.

For an example, see the [Secrets store guide](https://create.roblox.com/docs/cloud/guides/secrets-store).

## Path parameters

- `universeId` integer, required
- `secretId` string, required

## Request body

- Secret — Universe-specific secret, identified by `id`, and belonging to a specific `environment`.
  - `id` string, nullable — The user-specified secret name. Examples: "aws", "gcp", "discord". Static when getting the public key for a universe. Must be alphanumeric or underscore, 1-64 characters, not starting with a number.
  - `secret` string, byte, nullable — The binary secret content. Examples: API key content (text), private keys. When created, the secret must be encrypted using LibSodium sealed box and encoded in base64 with the universe's public key. Contains the public key when getting the public key for a universe.
  - `key_id` string, nullable — Encryption key identifier. Identifies the key that was used to encrypt the secret content.
  - `domain` string, nullable — The domain wildcard that restricts the purpose of the key. You can restrict the URLs callable via HttpService to a specific domain, e.g. "api.example.com" or "*.myservice.org". An empty or null domain means that the secret is a private key and cannot be transformed with addPrefix/addSuffix or sent as a header or URL. In order to make the secret accessible for all domains, use "*"
  - `create_time` string, nullable — Date and time when the secret was originally created.
  - `update_time` string, nullable — Date and time when the secret was last updated

## Response `200`

OK

- Secret — Universe-specific secret, identified by `id`, and belonging to a specific `environment`.
  - `id` string, nullable — The user-specified secret name. Examples: "aws", "gcp", "discord". Static when getting the public key for a universe. Must be alphanumeric or underscore, 1-64 characters, not starting with a number.
  - `secret` string, byte, nullable — The binary secret content. Examples: API key content (text), private keys. When created, the secret must be encrypted using LibSodium sealed box and encoded in base64 with the universe's public key. Contains the public key when getting the public key for a universe.
  - `key_id` string, nullable — Encryption key identifier. Identifies the key that was used to encrypt the secret content.
  - `domain` string, nullable — The domain wildcard that restricts the purpose of the key. You can restrict the URLs callable via HttpService to a specific domain, e.g. "api.example.com" or "*.myservice.org". An empty or null domain means that the secret is a private key and cannot be transformed with addPrefix/addSuffix or sent as a header or URL. In order to make the secret accessible for all domains, use "*"
  - `create_time` string, nullable — Date and time when the secret was originally created.
  - `update_time` string, nullable — Date and time when the secret was last updated

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.net/roblox/apis/roblox-api.md) · [All operations](https://skmtc.net/roblox/apis/roblox-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/roblox/roblox-api/revisions/ece7c5a315e7/schema)