Auth Secret

API & MCP

Public, unauthenticated endpoints for any language or framework. The browser generator still creates secrets locally. Server endpoints use Web Crypto, send Cache-Control: no-store, never log values, and allow 60 requests per minute per IP.

REST

GET or POST /api/v1/secret (also /api). Query or JSON: bytes / length (8–256, default 32), encoding / format (base64 | base64url | hex), count (1–20), output (json default, or text for agents).

curl "https://www.auth-secret.com/api/v1/secret?bytes=32&encoding=base64"

Plain text (no JSON to parse)

curl "https://www.auth-secret.com/api/v1/secret?output=text"

POST JSON

curl -X POST "https://www.auth-secret.com/api/v1/secret" \
  -H "Content-Type: application/json" \
  -d '{"bytes":32,"encoding":"hex","output":"json"}'
{
  "secrets": ["…"],
  "bytes": 32,
  "encoding": "base64",
  "entropyBits": 256
}

OpenAPI 3.1: /api/v1/openapi.json

CLI

Generate a secret in the terminal with Node.js 20+: npx auth-secret.

npx auth-secret
npx auth-secret --bytes 32 --encoding base64
npx auth-secret --env AUTH_SECRET

Framework URLs

Sharable generator pages keep the matching env key, length, and encoding. Query params bytes and encoding override the preset.

MCP

Streamable HTTP at https://www.auth-secret.com/api/mcp. Tool: generate_secret with the same bytes, encoding, and count arguments.

Cursor / Claude (remote URL)

{
  "mcpServers": {
    "auth-secret": {
      "url": "https://www.auth-secret.com/api/mcp"
    }
  }
}

stdio-only clients

{
  "mcpServers": {
    "auth-secret": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://www.auth-secret.com/api/mcp"]
    }
  }
}

Security

  • Browser secrets are created with the Web Crypto CSPRNG and never sent to the server.
  • API and MCP responses are not cached. Generated values are not written to logs or storage. Both endpoints are limited to 60 requests per minute per IP.
  • Transport security headers include HSTS, a restrictive CSP, and clickjacking protections.