{"repo":"smallwat3r/secretapi","free":true,"listed":false,"github":"https://github.com/smallwat3r/secretapi","clone":"git clone https://github.com/smallwat3r/secretapi.git","description":"A lightweight, self-hostable app for securely sharing short-lived, one-time-read secrets.","language":"Go","stars":33,"topics":[],"license":"MIT","category":"self-hosted-apps","readme_excerpt":"SecretAPI SecretAPI is a lightweight (image 10MB on Docker Hub), self-hostable API for securely sharing short-lived secrets such as passwords, tokens, or messages. Each secret is encrypted with a server-generated passcode and stored temporarily in Redis with a chosen expiry time (1 hour, 6 hours, 1 day, or 3 days). A secret can only be read once with the correct passcode. After that, it is deleted automatically. If a wrong passcode is used too many times, the secret is permanently removed. How it works When a secret is created: 1. A plaintext message is sent to the /create endpoint. 2. The server generates a passcode by combining three random words from a word list (e.g., shore-outdoors-letter ). 3. A unique salt (16 bytes) is generated, and a 256-bit encryption key is derived from the passcode using the Argon2id key derivation function. 4. The message is encrypted using AES-256 in Galois/Counter Mode (GCM). 5. The salt, nonce, and ciphertext are combined and Base64-encoded for safe storage as a single string. 6. The encoded blob is stored in Redis under a unique UUID key, with an expiry time set according to user choice. 7. The secret's ID and the generated passcode are returned to the user. When someone retrieves the secret through POST /read/{id} , the service: - Fetches the encrypted blob. - Extracts the salt and nonce. - Recreates the encryption key using Argon2id from the passcode in the X-Passcode header. - Decrypts the ciphertext using AES-GCM. If the passcode matches","default_branch":null,"files":null,"tree":[],"storefront":"/r/smallwat3r","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/smallwat3r/secretapi/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}