diff --git a/controller/secrets.go b/controller/secrets.go
index 1054f6f6..4f28e85d 100644
--- a/controller/secrets.go
+++ b/controller/secrets.go
@@ -47,5 +47,27 @@ type secretsGrpcImpl struct {
 
 func (i *secretsGrpcImpl) FetchSecrets(_ context.Context, req *secretsGrpc.SecretsRequest) (*secretsGrpc.SecretsResponse, error) {
 	logrus.Infof("request for secrets for '%v'", req.ShareToken)
-	return nil, nil
+
+	trx, err := str.Begin()
+	if err != nil {
+		return nil, err
+	}
+	defer trx.Rollback()
+
+	shr, err := str.FindShareWithToken(req.ShareToken, trx)
+	if err != nil {
+		return nil, err
+	}
+
+	secrets, err := str.GetSecrets(shr.Id, trx)
+	if err != nil {
+		return nil, err
+	}
+
+	out := &secretsGrpc.SecretsResponse{}
+	for _, secret := range secrets.Secrets {
+		out.Secrets = append(out.Secrets, &secretsGrpc.Secret{Key: secret.Key, Value: secret.Value})
+	}
+
+	return out, nil
 }
diff --git a/controller/store/secret.go b/controller/store/secret.go
index 34bd207d..5e6f6550 100644
--- a/controller/store/secret.go
+++ b/controller/store/secret.go
@@ -32,7 +32,7 @@ func (str *Store) CreateSecrets(secrets Secrets, trx *sqlx.Tx) error {
 
 func (str *Store) GetSecrets(shareId int, trx *sqlx.Tx) (Secrets, error) {
 	secrets := Secrets{}
-	rows, err := trx.Queryx("select * from secrets where share_id = $1 and not deleted", shareId)
+	rows, err := trx.Queryx("select key, value from secrets where share_id = $1 and not deleted", shareId)
 	if err != nil {
 		return Secrets{}, errors.Wrap(err, "error getting all from secrets")
 	}