One-time secret API

Hand over a secret once.
We never hold the key.

Seal a credential in your client, send a link, and cap it at one read. Ask the recipient for a passphrase or an emailed code before it opens, and get a signed webhook when it does.

Start for free Read the API docs

AES-256-GCM

sealed before it reaches us

1

statement decides the read

$0

10,000 operations a month

One-time handoff

Encrypted before it left the sender

We hold ciphertext; the key stays in the link

Waiting for the one read…

Sealed

Encrypted before it reaches us, or refused

Every payload has to arrive as an envelope sealed in the sender’s client. Anything else gets a 400, not a row in our database.

The console seals in your browser. Through the API, you seal before the call.
The key rides in the link’s fragment, which browsers never send to a server.
A dump of our database yields ciphertext and hashes of retrieval codes.
We check an envelope’s shape, not that its contents are really encrypted. The security page says what that does and does not prove.

Once

One read, decided in one statement

Cap a secret at one read and exactly one request gets it, even when two arrive together. The read and the recipient check happen in the same conditional UPDATE.

The console caps every secret it sends at one read.
Revoke a secret before it is read. Every secret expires.
Retrieval codes are 256-bit and stored only as a hash.

Recipient · Team

Check who opens it

Before the secret shows, ask the recipient for a passphrase you chose or a 6-digit code we email them. Set it when you create the secret through the API.

Checked inside the same statement as the read, so a wrong answer cannot race a right one.
Wrong answers lock the secret after five tries, or the limit you set.
Passphrases are stored with scrypt and a per-secret salt.
Per-API-key IP allowlists fence the sending side too.

Receipts · Team

Know when it is read, and prove it later

A signed webhook fires when a secret is revealed, with the time and the IP. The audit log records every create, read, revoke, expiry and failed attempt.

Webhooks are signed with HMAC-SHA256 and retried with backoff.
Audit history for 90 days on Team and 365 on Enterprise.
Export it as CSV on Team, or stream it to a webhook or S3 on Enterprise.

API

Made to be called by code, and by agents

An OpenAPI 3.1 spec, an llms.txt, and responses that tell a script where it stands.

Quota headers on every metered response. Past the allowance we keep serving, up to twice it, and email you on the way.
A 402 that names the plan a capability needs, with a link to get it.
A sandbox key with no signup: 100 operations, 24 hours. Secrets need a claimed account.
An MCP server is in build. It will have no read tool.

Before you decide

See where the others win

Onetime Secret and Vaulted do parts of this for free. Our comparison pages say where they are the better choice.

X-TKN vs Onetime Secret X-TKN vs Vaulted

Hand over a secret once.We never hold the key.