How do I enable and use one-time secrets in ProVide?

What is One-Time Secrets in ProVide? #

One-Time Secrets is a ProVide feature for sharing sensitive text, such as a password, API key, or license code, through a link that can be opened exactly once. A user creates the link from the ProVide web interface, and the moment the recipient reveals the content, ProVide deletes it from the server. It works in both directions: “Send a secret” delivers text to someone else, and “Request a secret” lets someone else deliver text to you, both with the same one-time guarantee.

The feature exists so that passwords and keys stop piling up in inboxes and chat histories, where they get copied into backups, forwarded, and kept searchable indefinitely. One-Time Secrets keeps the value on your own ProVide server, under your existing security and audit policies, until it has been seen once, then removes it.

How do I send a secret using ProVide? #

Open One-Time Secrets in the ProVide web interface and choose “Send a secret.” Paste the text, decide who can open it, and copy the generated link to share through whichever channel you like.

1. Click “Send a secret” and paste the text you want to share, up to the size limit your administrator has set (4,096 characters by default).
   
   
   
   
2. Choose the audience: anyone with the link, or one specific person who must verify their identity before the secret is shown. (To be able to select People you choose, the Administrator needs to enable MFA with Email one-time code.)
   
   
   
   
3. Optionally add an access password and a validity window, then click Create secret link.
   
   
   
   
4. Copy the link.
   
   
   
   
5. Send the link to the recipient through any channel. For extra safety, send the link and its password through two different channels, for example a chat message and a phone call.
   
   
6. The recipient opens the link and presses Reveal to see the secret once. As soon as they do, ProVide deletes it from the server.
   
   
   
   

Opening or refreshing the link’s page does not consume the secret.
Only pressing Reveal displays the secret, so link previews generated by tools like Outlook or Teams can’t burn it by accident.

Once it’s revealed, a countdown timer starts. When it runs out, the secret is hidden again, and there’s no way to view it a second time: it’s no longer stored on the server. Copy it while you still have time.

How do I request a secret from someone using ProVide? #

Open One-Time Secrets and choose “Request a secret.” This creates a link you send to the other person; they submit their text once, and only you can reveal what they submitted.

1. Click “Request a secret” and write a short message explaining what you need, for example “Please submit the production API key here.”
   
   
   
   
   
   
   
2. Send the link to the other party. They do not need a ProVide account.
   
   
   
   
3. They submit their text exactly once. The confirmation page they see never echoes back what they typed.
   
   
   
   
   
   
4. The requester can reveal the submission once. After that, it’s deleted from the server the same way a sent secret would be.
   
   
   
   
   
   
   
   

This makes collecting credentials from customers or contractors as safe as sending them, instead of asking them to email or message a password back to you.

How does ProVide make sure a one-time secret can really only be seen once? #

ProVide deletes a secret from the server before it is displayed, and it never writes the secret to any log or backup made after that point. This holds even on a clustered, high-availability ProVide deployment: all nodes in the cluster agree before any reveal happens, so a secret can be revealed exactly once even if it’s requested from two different nodes at the same time.

A few additional details worth knowing:

• A revealed secret hides itself from the screen automatically, 90 seconds by default (your administrator can change this), and immediately if the browser tab loses focus.
• The page a recipient opens refuses caching, search indexing, and embedding on other sites, and a link preview or page refresh does not consume the secret. Only pressing Reveal does.
• ProVide cannot control what a recipient does after seeing the secret, such as taking a screenshot or copying it elsewhere. What it removes is the stored copy on the server and the ongoing exposure of leaving that value sitting in a mailbox or chat log.

Can I restrict who is allowed to open a one-time secret? #

Yes. When you send or request a secret, you can choose “anyone with the link” or restrict it to one specific named recipient who must verify their identity before anything is shown.

Named-recipient verification works one of two ways:

• A one-time code sent to the recipient’s email address, which they enter before the secret is displayed.
• The organization’s own single sign-on (OIDC), if your administrator has set this up.

If the recipient cannot complete verification, the secret stays sealed. It never falls back to being openable by link alone. You can also add an access password and a validity window (up to a 7-day maximum by default, if your administrator has enabled that limit) for an extra layer of control on top of the recipient restriction.

What can administrators control for One-Time Secrets? #

One-Time Secrets is off by default, and an administrator turns it on separately for each direction, either globally or for specific users and groups. From there, the administrator can require or forbid an access password, require recipient verification, cap the validity window and secret size, and rely on built-in rate limiting that throttles brute-force and link-guessing attempts.

Other administrator-facing details:

• Default secret size limit is 4,096 characters per secret, adjustable per direction.
• Default maximum validity window is 7 days, when the duration policy is enabled.
• The recipient-facing pages run under your own domain and branding, and the interface is available in 25 languages.
• Nothing changes for an existing ProVide installation until an administrator switches the feature on.