Secryn can expose one key or one certificate without a vault access key. Public access is disabled by default and must be enabled per resource. The caller still presents that resource's bearer token. The endpoint is not an open link.

What Is a Public URL?

A public resource has a read-only API endpoint scoped to that single key or certificate:

• Keys: GET /api/v1/keys/{key_id} with Authorization: Bearer <resource public token>
• Certificates: GET /api/v1/certificates/{certificate_id} with Authorization: Bearer <resource public token>

The token bypasses project and vault access checks for that resource only. The route accepts GET and HEAD. Revoking public visibility or disabling the resource stops the token from working.

Supported Resources

• Keys
• Certificates

Secrets are never exposed via public URLs.

Public Keys

“Public” means this token returns public material only. For a key, that is the public key, never the private key. The private key file stays in a SECRYN-PRIVATE-V1 envelope encrypted with APP_KEY. Enabling public visibility does not put the private key in the response.

Public Certificates

The certificate endpoint returns that certificate, never the certificate private key. Certificates are not versioned, so the endpoint returns the stored certificate, not a later replacement. Disabled or expired certificates stop resolving. The certificate private key is stored in a SECRYN-PRIVATE-V1 envelope encrypted with APP_KEY. Treat the public token as a secret.

Security Considerations

Treat public URLs as sensitive access links:

• share only with trusted parties
• revoke immediately if exposure is suspected
• avoid enabling public access unless required
• use lifecycle controls and expiration to reduce risk

Public token requests are recorded in request logs.

Revoking Public Access

Disable the Public URL toggle, disable the resource, or delete the resource to revoke access. Revocation takes effect immediately.

When to Use Public URLs

• a client must fetch one public key without a vault access key
• a client must fetch one certificate without a vault access key

The response never includes a private key. Prefer the vault access key when the caller needs the private key, and leave public visibility off unless that separate token is required. Rotate any private key whose public link was enabled before this release.