hushhh hushhh/api-sandbox
LIVE INTERACTIVE API SANDBOX

REST API & cURL Console

Configure requests, view real-time cURL command generation, and execute live API calls in-situ.

POST /api/secrets (Aliases: /, /secret)

Creates a one-time secret payload. Accepts JSON, URL-encoded form data, or raw string bodies. Returns a secret ID and shareable URL.

Sent as Authorization: Bearer <token>. Without one, requests use anonymous limits (50KB content, 30-day max expiry).

[ API SPECIFICATION REFERENCE ]

FieldTypeLocationDescription
contentstringBodySecret payload text. Aliases: secret, text, data, or raw body.
expiresintegerBody / QueryExpiration in seconds (60 to 2592000). Default: 86400 (24 hours).
isEncryptedbooleanBodyDefaults to false for API requests.
rawbooleanQueryIf raw=true, returns raw text body instead of JSON wrapper.
AuthorizationheaderHeaderOptional. Bearer <token> — authenticates as a member, applying member-tier limits to the request. Also accepted: the hushhh_user_session cookie set by logging in through the browser.

[ MEMBER ACCOUNTS & API TOKENS ]

Create a free account →

Accounts are entirely optional — every endpoint above works anonymously with no change in behavior. Registering lets you see and revoke your own secrets from /account, where you can also generate an API token for scripted or cURL access without a browser session. Paste it into the field above to try it live.

AnonymousMember (Bearer token)
Max secret size50,000 chars500,000 chars
Max expiry30 days90 days
Secret creation rate limit10 / min60 / min

Logging in never grants the server access to your secret's content — only to metadata (id, expiry, status) via GET /api/users/me/secrets. E2EE content stays exactly as inaccessible to us as it is for anonymous secrets.

Generated cURL Command
Live Response Inspector
IDLE 0 ms
Response Body
Click "Send Request" to execute API call...
Copied to clipboard!