diff --git a/internal/services/common/secrets.go b/internal/services/common/secrets.go
new file mode 100644
index 0000000..885a64c
--- /dev/null
+++ b/internal/services/common/secrets.go
@@ -0,0 +1,42 @@
+// Copyright 2019 Sorint.lab
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package common
+
+import (
+	csapitypes "agola.io/agola/services/configstore/api/types"
+)
+
+func FilterOverriddenSecrets(secrets []*csapitypes.Secret) []*csapitypes.Secret {
+	secretsMap := map[string]*csapitypes.Secret{}
+	for _, s := range secrets {
+		if _, ok := secretsMap[s.Name]; !ok {
+			secretsMap[s.Name] = s
+		}
+	}
+
+	filteredSecrets := make([]*csapitypes.Secret, len(secretsMap))
+	i := 0
+	// keep the original order
+	for _, s := range secrets {
+		if _, ok := secretsMap[s.Name]; !ok {
+			continue
+		}
+		filteredSecrets[i] = s
+		delete(secretsMap, s.Name)
+		i++
+	}
+
+	return filteredSecrets
+}
diff --git a/internal/services/gateway/action/secret.go b/internal/services/gateway/action/secret.go
index 9539611..934257e 100644
--- a/internal/services/gateway/action/secret.go
+++ b/internal/services/gateway/action/secret.go
@@ -18,6 +18,7 @@ import (
 	"context"
 	"net/http"
 
+	"agola.io/agola/internal/services/common"
 	"agola.io/agola/internal/util"
 	csapitypes "agola.io/agola/services/configstore/api/types"
 	cstypes "agola.io/agola/services/configstore/types"
@@ -29,7 +30,8 @@ type GetSecretsRequest struct {
 	ParentType cstypes.ConfigType
 	ParentRef  string
 
-	Tree bool
+	Tree             bool
+	RemoveOverridden bool
 }
 
 func (h *ActionHandler) GetSecrets(ctx context.Context, req *GetSecretsRequest) ([]*csapitypes.Secret, error) {
@@ -46,6 +48,11 @@ func (h *ActionHandler) GetSecrets(ctx context.Context, req *GetSecretsRequest)
 		return nil, ErrFromRemote(resp, err)
 	}
 
+	if req.RemoveOverridden {
+		// remove overriden secrets
+		cssecrets = common.FilterOverriddenSecrets(cssecrets)
+	}
+
 	return cssecrets, nil
 }
 
diff --git a/internal/services/gateway/api/secret.go b/internal/services/gateway/api/secret.go
index 92acd72..9a5e33b 100644
--- a/internal/services/gateway/api/secret.go
+++ b/internal/services/gateway/api/secret.go
@@ -49,6 +49,7 @@ func (h *SecretHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	query := r.URL.Query()
 	_, tree := query["tree"]
+	_, removeoverridden := query["removeoverridden"]
 
 	parentType, parentRef, err := GetConfigTypeRef(r)
 	if httpError(w, err) {
@@ -57,9 +58,10 @@ func (h *SecretHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	areq := &action.GetSecretsRequest{
-		ParentType: parentType,
-		ParentRef:  parentRef,
-		Tree:       tree,
+		ParentType:       parentType,
+		ParentRef:        parentRef,
+		Tree:             tree,
+		RemoveOverridden: removeoverridden,
 	}
 	cssecrets, err := h.ah.GetSecrets(ctx, areq)
 	if httpError(w, err) {