---
title: "Retrieve OAuth API key secret"
method: GET
path: "/oauth2/api-key/{externalId}/secret"
tags: ["OAuth API Keys"]
---

# Retrieve OAuth API key secret

`GET /oauth2/api-key/{externalId}/secret`

The endpoint retrieves the API secret for a partner-issued API key. The endpoint returns the secret exactly once per key — a subsequent call returns `409 Conflict`.

**Required scope:** `apikeys.read`.

**Region availability:** The endpoint is available on the global server (`https://whitebit.com`) only.

<Warning>
Store the API secret in encrypted backend storage on first retrieval. The secret is not recoverable after this call returns.
</Warning>

## Path parameters

- `externalId` string, uuid, required

## Response `200`

Successful response. The secret is returned exactly once.

- object
  - `data` object
    - `apiSecret` string — The API secret. Persist immediately in encrypted backend storage — the secret is not recoverable.

## Other responses

- `401` — Missing or invalid Bearer token, or token does not carry the `apikeys.read` scope.
- `403` — The key does not belong to the authenticated OAuth2 client, or the key is not a partner-issued key.
- `404` — Key not found.
- `409` — The secret has already been retrieved for this key. Recovery requires deleting the key and restarting the OAuth API key flow.
- `423` — A concurrent secret-retrieval attempt holds the lock. Retry after a short delay.

---

[API](https://skmtc.net/whitebit/apis/whitebit-private-http-api-v4.md) · [All operations](https://skmtc.net/whitebit/apis/whitebit-private-http-api-v4/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whitebit/whitebit-private-http-api-v4/revisions/76c9def9942f/schema)