---
title: "Store a one-time secret"
method: POST
path: "/OneTimeSecrets"
tags: ["Onetimesecrets"]
---

# Store a one-time secret

`POST /OneTimeSecrets`

**Requires permission:** *IT*

Stores a payload the client has already encrypted, and returns a short link to it. The API receives ciphertext, KDF parameters and an auth key it only ever hashes — never the passphrase and never the plaintext, so it cannot read what it is holding.

## Request body

- PostOneTimeSecretRequest
  - `ciphertext` string, nullable
  - `nonce` string, nullable
  - `encryptionSalt` string, nullable
  - `authSalt` string, nullable
  - `iterations` integer
  - `authKey` string, nullable
  - `note` string, nullable
  - `expiresInHours` integer

## Response `200`

Success - stored

- PostOneTimeSecretResponse
  - `token` string
  - `url` string
  - `shortLinkBackHalf` string, nullable
  - `shareUrl` string
  - `expiresAt` string, date-time

## Other responses

- `400` — An Error Occurred - the envelope is incomplete
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.net/tonbridge/apis/tonbridge-app-api.md) · [All operations](https://skmtc.net/tonbridge/apis/tonbridge-app-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tonbridge/tonbridge-app-api/revisions/5aa4178ca29b/schema)