REST API

Secret-sharing API
for developers

Integrate password, API key and encrypted file sharing directly into your applications. The Seecret.it API is a simple REST API, Bearer-authenticated, with webhook on consultation, in JSON.

API documentation Code examples
Context

Why a secret-sharing API?

In a modern DevOps environment, technical credentials (DB passwords, API tokens, SSH keys, certificates) need to transit constantly: environment provisioning, automatic rotation, developer onboarding, multi-cloud deployment...

Storing these secrets in plain text in a script, a shared .env file on Slack, or an accidental Git commit is the #1 cause of infrastructure leaks. The Seecret.it API lets you send these secrets via a one-time link, generated programmatically.

Quickstart

Code examples

All examples create a secret with 24h expiration and 1 view allowed.

PHP

 true,
  CURLOPT_POST           => true,
  CURLOPT_HTTPHEADER     => [
    "Authorization: Bearer YOUR_TOKEN",
    "Content-Type: application/json"
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "operation"  => "create_seecret",
    "content"    => "Password2026!",
    "expiration" => "24h",
    "views"      => 1
  ])
]);
echo json_decode(curl_exec($ch), true)["url"];

Python

import requests

response = requests.post(
    "https://seecret.it/api.php",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type":  "application/json"
    },
    json={
        "operation":  "create_seecret",
        "content":    "Password2026!",
        "expiration": "24h",
        "views":      1
    }
)
print(response.json()["url"])

Node.js

const res = await fetch("https://seecret.it/api.php", {
  method:  "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type":  "application/json"
  },
  body: JSON.stringify({
    operation:  "create_seecret",
    content:    "Password2026!",
    expiration: "24h",
    views:      1
  })
});
console.log((await res.json()).url);

cURL

curl -X POST https://seecret.it/api.php \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operation":  "create_seecret",
    "content":    "Password2026!",
    "expiration": "24h",
    "views":      1
  }'
See full documentation
Capabilities

API features

Bearer authentication

A simple UUID token in the Authorization header. No complex OAuth.

6 REST operations

create_seecret, update_seecret, get_seecret, list_seecrets, delete_seecret, get_account.

Consultation webhook

HTTP POST notification on your endpoint when the secret is read. Ideal for auto-rotation.

File upload

PDF, .key, .pem, .zip up to 100 MB, encrypted server-side with destruction after download.

Geo-blocking

Restrict access to a list of allowed countries via the allowed_countries parameter.

Fast response

P95 under 80ms. Fair use 1000 req/min while Pro subscription is active.

Use cases

DevOps use cases

  • Terraform provisioning: create a secret at pipeline output to transmit generated credentials
  • Automatic rotation: consultation webhook triggers a rotation script
  • CI/CD GitHub Actions / GitLab CI: inject a job result into a shared link
  • Ansible / Puppet: custom module to distribute temporary secrets
  • Slack / Discord bot: /share-secret command that calls the API
  • Automatic onboarding: new employee provisioning triggers a secret with initial credentials
FAQ

Seecret.it API

The token is auto-generated in your dashboard after subscribing to Pro or Enterprise. One token per account, regenerable anytime.

No strict quota, but fair use of 1000 req/minute. Beyond, the API returns 429. For higher throughput, contact us for Enterprise.

Yes, each webhook is signed via HMAC-SHA256 with your webhook secret. Verify the signature in X-Seecret-Signature header.

Ready to integrate Seecret.it into your pipelines?

Pro plan at €2/month — unlimited API, email support.

Read docs Get a token