API

JSON over HTTPS. No account or token needed.

Create a secret

POST /api/create

curl -X POST https://otaoto.co/api/create \
  -H "content-type: application/json" \
  -d '{"secret": {"plain_text": "hunter2"}}'

201 Created

{
  "secret": {
    "slug": "Kc-TS1Jwzp4Y-euiQ5YHrg",
    "key": "AClBdIEvAoL4…",
    "link": "https://otaoto.co/gate/Kc-TS1Jwzp4Y-euiQ5YHrg?key=AClBdIEvAoL4…"
  }
}

Send link to a person. Keep slug and key to reveal it from code.

Reveal a secret

POST /api/show/:slug. Deletes the secret.

curl -X POST https://otaoto.co/api/show/Kc-TS1Jwzp4Y-euiQ5YHrg \
  -H "content-type: application/json" \
  -d '{"key": "AClBdIEvAoL4…"}'

200 OK

{"plain_text": "hunter2"}

Errors

400

Missing plain_text or key.

404

Wrong key, or the secret is already gone. The two are indistinguishable.

422

The secret couldn’t be saved.

Errors look like {"errors": ["…"]}.