Secrets

A secret is a short encrypted text (a password, a token, a note) behind a link that stops working once it is opened. There are two ways to create one, depending on where the encryption happens.

Encrypted in your client (we never see the value)

You encrypt the text in your client (the same envelope as a share) and post the encrypted text. The server never sees the value. It returns a URL without the key; the key stays in the part after the # that you add. This is what the CLI's share secret uses.

Email the secret link to people you name (each must ask for a code before it opens).

Secret upload links (secret handoffs in the API)

Where you cannot encrypt in the client (a chat-only assistant with no shell), create a handoff with "kind": "secret" and a notify_email. Give the returned URL to the person who knows the secret: they type it on that page, and their browser encrypts it and emails the link. Neither you nor the service sees the value. Optional: max_views, only_named (only notify_email can open it, after an emailed code), expiry_days, notify_message. Poll GET /api/v1/handoffs/{id} for emailed_to. There is no endpoint that takes the value itself.