# Get the API Secret

Your tenant's API secret, the key of the HMAC signature. For the Owner, Admin, Non-signing Admin and Security Admin roles.

## Overview

- `apiSecret` is `as_` and 64 hex characters.
- **Anyone holding it signs requests as your tenant.** Keep it on your server only — never in an app, a browser or a log — and read it only when you need it.
- How it signs a request: [Authentication › HMAC Request Signing](https://docs.aureahub.com/docs/authentication.md). How to replace it, and how to sign without it: [Credentials & Rotation](https://docs.aureahub.com/docs/guide-credentials.md).

## Endpoint

### `GET /v1/admin/tenants/{id}/api-secret`

Authentication: bearer token required.

Returns the tenant's API secret.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | Your tenant's id |

**Responses**

`200` OK

```json
{
  "apiSecret": "as_EXAMPLE000000000000000000000000000000000000000000000000000000001"
}
```

`403` Forbidden

```json
{
  "error": "ForbiddenError",
  "message": "Admin access required or you can only access your own tenant."
}
```

**Example request**

```bash
curl https://api.aureahub.com/v1/admin/tenants/TENANT_ID/api-secret \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#admin-tenants-secret