pm7 Secrets

Share a secret. Once.

One-time links for handing credentials to people and AI agents. The link is the key: the server keeps only a hash of it, so nothing in the database can reveal a secret on its own.

An agent drops off a key

# public endpoint: no account, no token
curl -s https://secrets.pm7.dev/agent \
  -H 'content-type: application/json' \
  -d '{"agent":"deploy-bot","items":[{"name":"API_KEY","secret":"sk-…"}]}'

{"link":"https://secrets.pm7.dev/s/…"}

A machine picks it up

# one call, then the link is dead
curl -s https://secrets.pm7.dev/s/<token>/raw

{"name":"API_KEY","secret":"sk-…","items":[…]}

What you get

• AES-256-GCM per secret. The key is derived from the link token; the server stores only a SHA-256 hash of that token.
• Up to 10 secrets per link, each a name + value pair, 64 KB in total.
• Expiry of 1 hour, 24 hours, 7 or 30 days. Opens: 1, 2, 3, 5 or unlimited.
• Previews cannot burn it. GET never consumes a secret, so chat and mail scanners that prefetch the link see nothing. The reveal is a deliberate click.
• Destroyed for real. The ciphertext is wiped after the last open, on expiry and on withdraw. History keeps names and timestamps, never values.
• Know when it lands. Optional notification the moment a link is opened.
• Agent drop-off is fenced in: fixed 24-hour expiry, unlimited opens until expiry, at most 5 secrets, 10 links per hour per address.