Secure

Manage store access tokens (master/owner only). The op field selects the operation - create (default), list, update, delete, reveal, reroll, identity, identity_update. The token is keyed by its HMAC id; list/update/delete/reveal/reroll address a token by that id (the hash). Tokens created after the reveal feature store an AES-encrypted copy of the raw value, so the reveal op can return it (legacy tokens predating this return a null token). The list op never includes the raw value. The reroll op replaces a token's raw value - a new token (new id) with the same role / access / scope / customer / note / metadata is written and the old value is revoked in the same batch; identity tokens minted from the old value are moved to the new one; a non-revealable token stays non-revealable. It answers {token, id, previous, identities, data} - the new raw token is shown here once (re-readable later through reveal when revealable). Platform-custodied tokens refuse it - module tokens with 409 managed_token, the tenant serving token (note CORE - Autogenerated, reroll through /project/hosting/reroll) and console member tokens (note MEMBER - Autogenerated) with 409 custodied_token. The identity op mints a user-level identity token derived from a parent access token (access_token override, or the caller's own token - a master token works as the parent too, so a master caller can mint directly); the new token inherits the parent's access tree with customer forced to user, is stored raw, and dies with the parent. The identity_update op edits an existing identity token's metadata in place (addressed by its raw identity token) - only note / meta / origins are mutable; an empty note or origins clears the field. Identity-token callers cannot mint or manage identity tokens. Module install tokens (note MODULE - {id}, minted by /api/module/install) are platform-managed - update, delete and reroll on one answer 409 managed_token; they change only through /api/module/{update,reroll,uninstall}.

Parameters

Sample request

{
  "note": "Blog editor (articles only)",
  "role": "editor",
  "access": {
    "fallback": false,
    "admin": true
  },
  "scope": {
    "fallback": false,
    "data": {
      "fallback": false,
      "articles": true,
      "pages": "read"
    },
    "files": true,
    "$store": "read"
  }
}

Creates a token (op defaults to create) that may call every admin/* verb, but only on the articles collection (any locale), read pages, write the files tree and read the store settings - every other path answers 403. Omit scope for an unrestricted token. Use op: list to see existing tokens.

Sync a single store's data between the Prod and Demo Firebase projects (master only). Copies Firestore documents under store/{sid}, Cloud Storage files under the store/{sid}/ prefix, and optionally the store's access tokens and secrets (admin-eur3) from the CURRENT environment to the target environment. Use mode to either mirror (wipe the target store first) or merge (upsert). Target env must differ from the current one. Access tokens and secrets only work in the target env when both share the same DROP_KEY.

Parameters

Sample request

{
  "sid": "{storeId}",
  "target_env": "demo",
  "mode": "merge",
  "include": {
    "firestore": true,
    "storage": true
  }
}

Copies the store from the current environment to target_env. Scope with include.docs (store-relative document paths) to sync single documents.

Process user managed secrets. This storage is typically used to handle api keys for third party services (like Stripe). A module install token (.dev/plans/custom-modules.md D30) reaches only its own keys - key must start with module_{id}_ and * is refused (403 module_secret_scope); the platform's custody of the token itself lives in another namespace this route never reads.

Parameters

Sample request

{
  "key": "stripe_key",
  "value": "sk_test_123abc",
  "params": {
    "note": "Stripe secret key (test mode)"
  }
}

Omit value to read the key's params, or set it to null to delete the secret. Use key: "*" to list all keys.

Exposes a secret, an access token, or a list of identity tokens. Pass secret (key) or access (raw token) to reveal one. Pass identities to list identity tokens instead - */true for all, or a customer id to scope to that user; an explicit user plus the standard list-query options narrow the result. Identity tokens are stored raw, so each item's id is a usable token value. Identity listing is admin-only (access-token caller, gated by the secure access tree); identity-token callers are rejected.

Parameters

Sample request

{
  "secret": "stripe_key"
}

Revokes a secret, an access token, or identity tokens. Pass secret (key) or access (raw token) to delete one. Pass identity (a raw identity token), user (every identity token of that customer), or both to revoke identity tokens - the response carries the number of tokens revoked. Identity revocation is admin-only (access-token caller, gated by the secure access tree); identity-token callers are rejected.

Parameters

Sample request

{
  "secret": "stripe_key"
}