Reveal a credential's secrets | Neon Postgres Docs

POST/projects/{project_id}/branches/{branch_id}/credentials/{token_id}/revealReveal a credential's secrets

Returns the live api_token and s3_secret_access_key of an existing credential, so a credential whose issuance response was lost can be recovered without minting a new one.

This is a POST with an explicit /reveal verb so the secrets never ride a GET, where they would land in access logs, browser history and proxy caches. Revoked and expired credentials return 404, as does a token_id that does not belong to this project.

A credential issued before secret retrieval was supported has no recoverable secret and returns 409 — rotate it to obtain one.

Note: This endpoint is currently in Beta.

Parameters

project_idstringpathrequired

The Neon project ID

pattern ^[a-z0-9-]{1,60}$

branch_idstringpathrequired

The Neon branch ID

pattern ^[a-z0-9-]{1,60}$

token_idstringpathrequired

The opaque credential id (e.g. nak_live_<32hex>).

Responses

objectCredentialSecret

The live secrets of an existing credential, recovered on demand by the reveal endpoint. `api_token` and `s3_secret_access_key` are the same values handed back once at issuance. The field set is deliberately narrower than `CreateCredentialResponse`: it carries only what reveal can actually recover. `token_id_short`, `scopes`, `principal_type`, `created_at` and `expires_at` are metadata, not secrets — read them from the list endpoint instead. No `branch_id` is returned. Reveal is scoped by `(project_id, token_id)`, so the branch in the request path authorizes the call but is not proven to be the branch the credential was issued on. Echoing it back would assert an anchor this endpoint never verified. For a credential's true anchor branch, read `branch_id` from the list endpoint, which is branch-exact.

api_tokenstringrequired

Bearer token.

s3_secret_access_keystringrequired

nsk_live_<64 hex>; the AWS_SECRET_ACCESS_KEY.

token_idstringrequired

Opaque credential id (e.g. nak_live_<32hex>).

Example response

{
  "api_token": "",
  "s3_secret_access_key": "string",
  "token_id": "string"
}

objectGeneralError

codestringrequired

default ""

messagestringrequired

Error message

request_idstring

Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.

Example response

{
  "code": "",
  "message": "string",
  "request_id": "string"
}

objectGeneralError

codestringrequired

default ""

messagestringrequired

Error message

request_idstring

Example response

{
  "code": "",
  "message": "string",
  "request_id": "string"
}

defaultGeneral Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. application/json

objectGeneralError

codestringrequired

default ""

messagestringrequired

Error message

request_idstring

Example response

{
  "code": "",
  "message": "string",
  "request_id": "string"
}

Examples

project_idrequiredpath parameter

branch_idrequiredpath parameter

token_idrequiredpath parameter

curl -X POST 'https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/reveal'

const response = await fetch('https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/reveal', { method: 'POST' });
const data = await response.json();

const response = await fetch('https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/reveal', { method: 'POST' });
console.log(await response.json());

import requests

response = requests.request("POST", "https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/reveal")
print(response.json())

package main

import (
	"context"
	"net/http"
)

func main() {
	ctx := context.Background()
	req, err := http.NewRequestWithContext(ctx, "POST", "https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/reveal", nil)
	if err != nil {
		panic(err)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
}

<?php
$request = curl_init("https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/reveal");
curl_setopt($request, CURLOPT_CUSTOMREQUEST, "POST");
$response = curl_exec($request);
curl_close($request);

var request = HttpRequest.newBuilder(URI.create("https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/reveal"))
    .method("POST", HttpRequest.BodyPublishers.noBody())
    .build();
var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());

require 'net/http'

uri = URI("https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/reveal")
request = Net::HTTPGenericRequest.new("POST", false, true, uri)
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/reveal");
using var response = await client.SendAsync(request);

{
  "api_token": "",
  "s3_secret_access_key": "string",
  "token_id": "string"
}

{
  "code": "",
  "message": "string",
  "request_id": "string"
}

{
  "code": "",
  "message": "string",
  "request_id": "string"
}

{
  "code": "",
  "message": "string",
  "request_id": "string"
}