HELP CENTRE
How to use EphemeralSecrets
Last updated: September 18, 2026
Getting started
EphemeralSecrets turns any text into a one-time link. The recipient opens it once, and the content is destroyed. Here is how it works:
- Sign in — Create an account through the fleet's shared auth
host at
auth.agen2ic.ai. You need any email address and a password. There is no cost. - Paste your secret — On the dashboard, type or paste the password, API key, token, or credential you want to share.
- Get a one-time link — Click "Generate One-Time Link" and copy the URL. Send it to the recipient through whatever channel you already use — email, chat, a ticket, Signal — we have no sender of our own.
- The secret disappears — The first person to open the link sees the content. After that, the page says "This secret no longer exists." The data is permanently gone.
That is the entire workflow. There is nothing more to set up, no team configuration, no API keys to generate — just paste, share, and forget.
Frequently asked questions
Do I need an account to receive a secret?
No. Anyone with the one-time link can open it. No account, no login, no sign-up required. The link is all you need. Only the person creating the secret needs an account, so they can see its status on their dashboard.
How long does a secret last?
A secret expires 24 hours after creation, whether it was opened or not. If the recipient opens the link before that, the secret is destroyed immediately on first view. There is no way to extend the expiry — the 24-hour limit exists to make sure secrets do not persist in the database longer than necessary.
What happens if two people open the link at the exact same moment?
Only one person gets the secret. The atomic database update ensures exactly one read succeeds; the other request receives a 404 response. The one-time guarantee is enforced at the storage layer, not by convention. This is not a race you can win by being fast.
Can I cancel or revoke a link after creating it?
No. Once a secret is created, the link cannot be revoked. If you created a link by mistake, the only option is to wait for the 24-hour expiry or contact the recipient directly. There is no "delete now" button because the entire product is designed around the principle that secrets should not be manipulable after creation.
Can I see who read my secret, or when?
No. The dashboard shows whether a secret was consumed versus expired, but it does not record who opened it or at what time. This product intentionally does not track recipients. If you need an audit trail of who accessed what, this is not the right tool.
Is the secret encrypted while stored?
Not in this version. Secrets are stored as plaintext in the Cloudflare D1 database. There is no encryption at rest. For this reason, you should not use EphemeralSecrets for secrets whose exposure would be a legally reportable incident or cause material harm. It is appropriate for low-risk credentials — temporary API keys, staging passwords, or single-use tokens.
Known limitations
EphemeralSecrets is a single-purpose tool. It does one thing and does not pretend to do more. These are the limitations you should know about before using it:
- Secrets are not encrypted at rest. Data is stored as plaintext in the database. Acceptable for low-risk credentials only.
- No link revocation. Once created, a link cannot be cancelled or deleted before its natural expiry.
- No audit log. The product does not record who opened a secret, from what IP, or at what time. It records only whether the secret was consumed or expired.
- No team features. There are no roles, no shared workspaces, no approvals, and no multi-user workflows. The product is designed for one person sharing one secret at a time.
- No API. There is no programmatic interface for creating, managing, or reading secrets. Everything runs through the web UI.
- No email notifications. The fleet has no email sender. You share the link yourself through your own channel. The product cannot send you a reminder, an alert, or a delivery confirmation.
- 100 KB maximum per secret. Secrets larger than 100 KB are rejected. The product is built for credentials and short text, not files.
- 24-hour fixed expiry. The expiry time cannot be customised. Every secret expires exactly 24 hours after creation, regardless of content or use case.
- A single authenticated person. The entire product assumes exactly one signed-in user creating secrets. There is no team or organisation model, and the dashboard only shows your own secrets.
- No mobile app. The web UI is responsive but there is no native mobile client. Use your phone's browser.
Feature requests
This tool does exactly what it sets out to do and no more. If you need something it does not offer — encryption at rest, link revocation, an API, custom expiry times — the honest answer is that those features are not planned. Existing tools like HashiCorp Vault, Doppler, or Infisical may serve your needs better.
If you believe something is genuinely broken or missing from the core use case, you can send a note to the address below and it will be reviewed.
Contact us
If something is not working, or you need help with your account, email us at:
Include the email address you used to sign in and a description of what you were doing when the issue occurred. We read every message, but please expect a response within a few business days.
For security-sensitive matters, email the same address with "Security" in the subject line. EphemeralSecrets is operated by Agen2ic, LLC, a Colorado limited liability company.