Skip to main content
A share link hands out secret values to someone outside the workspace — a contractor, a support engineer, a colleague who has not signed up yet. The link carries its own expiry and a view budget, and stops working when either runs out.
Secure sharing is a paid capability. On a plan without it the create call answers 402. See Plans and limits.
​
UUID[]
Which secrets to share. Omit the field entirely to share every secret in the environment. An empty array is rejected, and unknown ids come back as a 404 listing them.
​
integer
default:"60"
Lifetime of the link, between 1 and 10080 (seven days).
​
integer
default:"1"
How many times the link may be redeemed, between 1 and 100. The default is single-use.
The response carries the link to send:

​
What the recipient sees

Opening the URL loads a page that reports how many secrets are behind the link, when it expires and how many views remain — without spending one. Chat clients unfurl links and browsers prefetch them, and neither should burn the recipient’s only view. The values are only released when the recipient actively asks for them, which the page does by POSTing back to the same path.
Redeeming is POST /share/{token}, not GET. A bare GET is always safe to follow.
Redemption is unauthenticated by design: possession of the token is the credential. When the last view is spent the link is deleted immediately.

​
What gets recorded

Creating a link writes a SHARED audit entry against every secret in it, attributed to the member who created it. Each redemption writes an ACCESSED entry against the same secrets — also attributed to the sharer, since the recipient is anonymous by construction. Both show up in the secret’s log.

​
Practical limits

Share links live in a store with a TTL, so they disappear on their own even if nobody opens them. The two public routes are rate limited per calling address — 30 page views and 10 redemptions a minute — so a leaked link cannot be walked through quickly from one machine.
A share link is a bearer credential in a URL. Anyone who sees the message it was sent in can spend a view. Keep max_views at 1 and the expiry short unless you have a reason not to, and rotate the value afterwards if the channel was not private.