Manage GitHub Secrets Using GitHub REST API

Things on this page are fragmentary and immature notes/thoughts of the author. Please read with your own judgement!

import getpass
import os
import subprocess
from requests.exceptions import HTTPError
from github_rest_api import Organization, Repository, RepositoryType, User

env = os.environ.copy()
env["GOPASS_AGE_PASSWORD"] = getpass.getpass("Enter gopass password: ")
token = subprocess.run(
    ["gopass", "show", "-o", "github.com/token"],
    check=True,
    capture_output=True,
    text=True,
    env=env,
).stdout

List Secrets in a Repository¶

repo = Repository(token=token, repo="legendu-net/poker-rs")
repo

<github_rest_api.github.Repository at 0x7ffb2c33be00>

repo.get_secrets()

[{'name': 'GITHUBACTIONS',
  'created_at': '2026-06-20T17:35:49Z',
  'updated_at': '2026-06-20T17:35:49Z'}]

List Secrets in a Organization¶

org = Organization(token=token, org="legendu-net")
org

<github_rest_api.github.Organization at 0x7ffb24611160>

org.get_secrets()

[{'name': 'DOCKER_BASE_DISPATCH',
  'created_at': '2026-01-08T18:56:08Z',
  'updated_at': '2026-01-08T19:01:57Z',
  'visibility': 'selected',
  'selected_repositories_url': 'https://api.github.com/orgs/legendu-net/actions/secrets/DOCKER_BASE_DISPATCH/repositories'},
 {'name': 'GITHUBACTIONS',
  'created_at': '2022-05-03T20:39:04Z',
  'updated_at': '2026-06-20T17:34:54Z',
  'visibility': 'all'},
 {'name': 'PYPI_GITHUB_REST_API',
  'created_at': '2026-01-02T01:23:21Z',
  'updated_at': '2026-01-02T01:23:21Z',
  'visibility': 'all'},
 {'name': 'PYPI_TOKEN',
  'created_at': '2026-01-02T01:30:11Z',
  'updated_at': '2026-01-02T01:30:11Z',
  'visibility': 'all'}]

Add/Update a Secret¶

repo = Repository(token=token, repo="dclong/test")

repo.get_secrets()

[]

public_key = repo.get_secret_public_key()

repo.create_or_update_secret(
    name="MY_TOKEN",
    value="this is a fake token",
    public_key=public_key,
)

<Response [201]>

repo.get_secrets()

[{'name': 'MY_TOKEN',
  'created_at': '2026-06-21T00:48:19Z',
  'updated_at': '2026-06-21T00:48:19Z'}]

Delete a Secret¶

repo.delete_secret("MY_TOKEN")

<Response [204]>

repo.get_secrets()

[]