bithuman-ai API secrets API

openapi: 3.2.0
info:
  title: Bithuman Ai API secrets API
  version: '1.0'
  contact:
    name: bitHuman Support
    url: https://www.bithuman.ai/discord
  x-logo:
    url: https://docs.bithuman.ai/bithuman-mark.png
  description: 'Operations tagged API secrets across 2 of this provider''s published API definitions: openapi.yaml, bithuman-ai-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.bithuman.ai
  description: Production
security:
- apiSecret: []
tags:
- name: API secrets
  description: 'Create, list and delete your account''s API secrets: https://docs.bithuman.ai/api/api-keys.'
paths:
  /v2/{user_id}/api-secrets:
    parameters:
    - $ref: '#/components/parameters/UserId'
    post:
      operationId: createApiSecret
      x-codeSamples:
      - lang: shell
        label: cURL
        source: "curl -X POST \"https://api.bithuman.ai/v2/$USER_ID/api-secrets\" \\\n  -H \"api-secret: $BITHUMAN_API_SECRET\" -H \"content-type: application/json\" \\\n  -d '{\"alias\":\"prod-server\"}'\n"
      summary: Create an API secret
      description: 'Creates an API secret on your account. The response is the **only**

        one that returns the full secret: store it now. Send `{}` for an

        auto-generated alias; a request with no body returns `400`.'
      tags:
      - API secrets
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                alias:
                  type: string
                  description: A label for the API secret. Auto-generated (a timestamp) if omitted.
                  example: prod-server
      responses:
        '200':
          description: The new secret, returned once.
          content:
            application/json:
              example:
                alias: prod-server
                secret: k7m2p9x4…Sn3Q8vT1w…aC8e
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: '`FORBIDDEN` — the `user_id` in the path is not yours.'
        '404':
          description: Account not found.
        '409':
          description: An API secret with this alias already exists.
    get:
      operationId: listApiSecrets
      x-codeSamples:
      - lang: shell
        label: cURL
        source: 'curl "https://api.bithuman.ai/v2/$USER_ID/api-secrets" -H "api-secret: $BITHUMAN_API_SECRET"

          '
      summary: List API secrets
      description: 'Your API secrets, masked. The raw secret is never returned here, only

        `key_display`. `name`, `key` and `alias` all carry the alias label.'
      tags:
      - API secrets
      responses:
        '200':
          description: The masked list.
          content:
            application/json:
              example:
                user_id: 8f14e45f-…
                data:
                - alias: prod-server
                  name: prod-server
                  key_display: k7m2p9x4••••••••••••••••••••aC8e
                  created_at: '2026-07-15T15:30:45Z'
                total_count: 1
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: '`FORBIDDEN` — the `user_id` in the path is not yours.'
    servers:
    - url: https://api.bithuman.ai
      description: Production
  /v2/{user_id}/api-secrets/{alias}/get-value:
    parameters:
    - $ref: '#/components/parameters/UserId'
    - name: alias
      in: path
      required: true
      schema:
        type: string
      description: The API secret's alias.
    get:
      operationId: revealApiSecret
      x-codeSamples:
      - lang: shell
        label: cURL
        source: "curl \"https://api.bithuman.ai/v2/$USER_ID/api-secrets/prod-server/get-value\" \\\n  -H \"api-secret: $BITHUMAN_API_SECRET\"\n"
      summary: Reveal an API secret (console only)
      description: 'Console-only: only the signed-in owner can reveal a stored secret, in

        the Console under Developer → API Secrets. Called with an API secret

        it always returns `403 SECRET_REVEAL_CONSOLE_ONLY`, so one leaked

        secret cannot read your others.'
      tags:
      - API secrets
      responses:
        '403':
          description: '`SECRET_REVEAL_CONSOLE_ONLY` — reveal it in the Console, or create a new secret.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://api.bithuman.ai
      description: Production
  /v2/{user_id}/api-secrets/{alias}:
    parameters:
    - $ref: '#/components/parameters/UserId'
    - name: alias
      in: path
      required: true
      schema:
        type: string
      description: The API secret's alias.
    delete:
      operationId: deleteApiSecret
      x-codeSamples:
      - lang: shell
        label: cURL
        source: "curl -X DELETE \"https://api.bithuman.ai/v2/$USER_ID/api-secrets/prod-server\" \\\n  -H \"api-secret: $BITHUMAN_API_SECRET\"\n"
      summary: Delete an API secret
      description: 'Removes an API secret and revokes it at the runtime at once. Only that

        secret stops working; to stop every secret, use

        `POST /v2/{user_id}/runtime/revoke-all`.'
      tags:
      - API secrets
      responses:
        '200':
          description: Deleted.
          content:
            application/json:
              example:
                alias: prod-server
                message: API secret deleted successfully
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: No API secret with that alias.
    servers:
    - url: https://api.bithuman.ai
      description: Production
components:
  responses:
    Unauthorized:
      description: 'Authentication failed. `UNAUTHORIZED` when the `api-secret` header is

        present but invalid; `MISSING_AUTH` when it is absent. The HTTP status

        equals `status_code` (401).

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: UNAUTHORIZED
              message: Invalid API secret
              httpStatus: 401
            status: error
            status_code: 401
    BadRequest:
      description: Missing required parameter or malformed request. The HTTP status equals `status_code` (400).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: MISSING_PARAM
              message: 'Missing required field: text'
              httpStatus: 400
            status: error
            status_code: 400
  parameters:
    UserId:
      name: user_id
      in: path
      required: true
      schema:
        type: string
      description: Your own account id, from `GET /v1/me` (`data.user_id`). Another account's id returns `403 FORBIDDEN`.
  schemas:
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: UNAUTHORIZED
            message:
              type: string
              example: Invalid API secret
            httpStatus:
              type: integer
              example: 401
            upgrade_url:
              type: string
              description: 'On `PLAN_REQUIRED`, `AGENT_LIMIT_REACHED` and `CONCURRENCY_LIMIT_REACHED` (403): where to choose a plan. Send the user there instead of retrying. See [Plan and credit refusals](https://docs.bithuman.ai/api/errors#plan-and-credit-refusals).'
              example: https://www.bithuman.ai/pricing
            topup_url:
              type: string
              description: 'On `INSUFFICIENT_BALANCE` (402): where to top up credits.'
              example: https://www.bithuman.ai/billing#credits
            details:
              type: object
              description: Code-specific fields. `CONCURRENCY_LIMIT_REACHED` sends `tier`, `cap`, `active` and `upgrade_url`.
              additionalProperties: true
        status:
          type: string
          example: error
        status_code:
          type: integer
          example: 401
  securitySchemes:
    apiSecret:
      type: apiKey
      name: api-secret
      in: header
      description: 'Your bitHuman API secret. Get one at

        [www.bithuman.ai/developer/api-keys](https://www.bithuman.ai/developer/api-keys).

        '
    bearerApiSecret:
      type: http
      scheme: bearer
      description: 'The same API secret, sent as `Authorization: Bearer <api-secret>`. Self-

        hosted runtimes send it this way; the classic `api-secret` header works

        on the same routes.

        '
x-refined-from:
- openapi.yaml
- bithuman-ai-openapi.yaml
x-tagGroups:
- name: Get started
  tags:
  - overview
  - quickstart
  - auth-guide
  - models
  - pricing
- name: Core concepts
  tags:
  - avatars-imx
  - audio-streaming
  - agent-lifecycle
- name: SDKs
  tags:
  - sdk-python
  - sdk-swift
  - cli
- name: Guides
  tags:
  - local-mode
  - building-avatars
- name: Deployment
  tags:
  - deploy-livekit
  - deploy-self-hosted
  - deploy-embed
- name: API reference
  tags:
  - Authentication
  - Agent Generation
  - Agent Management
  - Agent Context
  - Files
  - Dynamics
  - Embedding
  - Video
  - Billing
  - Account
  - Self-hosting
  - API secrets
  - Providers
  - Runtime sessions
  - Knowledge
  - Realtime
  - Status
  - Webhooks
- name: Resources
  tags:
  - community
  - changelog
  - support