# Secret methods: revoke, rotate, store

URL: /code/sdk/secret/verbs · Id: `page:code/sdk/secret/verbs`

> The Secret Verbs revoke, rotate, store as typed SDK methods, with inputs, result, refusals and an example.

Reference for [Secret](/business/nouns/secret), one group of [Secret methods](/code/sdk/secret).

### Secret.revoke
Revoke ends a Secret so no call fills it again; the record and its history stay. [Verb page](/business/nouns/secret/revoke?interface=sdk).

```ts
interface SecretVerbs {
  revoke(input: SecretRevokeInput, options?: SB.CallOptions): SB.Call<Secret>
}
```

Emits [`Secret.revoked`](/business/events/Secret.revoked).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret to revoke. |
| `reason` | `text` | No | Why, such as a leaked value. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The revoked Secret. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```ts
import { $ } from 'startup-builder'

const secret = await $.Secret.revoke({ secret: 'secret_UaNXUkKsJB' })
```

### Secret.rotate
Rotate replaces a Secret’s value, and calls already running finish on the old one. [Verb page](/business/nouns/secret/rotate?interface=sdk).

```ts
interface SecretVerbs {
  rotate(input: SecretRotateInput, options?: SB.CallOptions): SB.Call<Secret>
}
```

Emits [`Secret.rotated`](/business/events/Secret.rotated).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret to rotate. |
| `value` | `string` | No | The new value; omitted when the upstream issues one. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret, with its new `rotatedAt`. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```ts
import { $ } from 'startup-builder'

const secret = await $.Secret.rotate({ secret: 'secret_UaNXUkKsJB' })
```

### Secret.store
Store writes a Secret’s value for one environment; the value is never returned by any Interface. [Verb page](/business/nouns/secret/store?interface=sdk).

```ts
interface SecretVerbs {
  store(input: SecretStoreInput, options?: SB.CallOptions): SB.Call<Secret>
}
```

Emits [`Secret.stored`](/business/events/Secret.stored).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | `string` | Yes | The name Functions declare. |
| `value` | `string` | Yes | The credential; write-only. |
| `environment` | `string` | Yes | Where it holds. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret, without its value. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```ts
import { $ } from 'startup-builder'

const secret = await $.Secret.store({ name: 'MAPS_KEY', value: 'Example value', environment: 'test' })
```