xport secrets

echo "$TOKEN" | xport --secret --once
cat ~/.ssh/id_rsa.pub | xport --secret --expires 1h
printf 'pg://app:%s@db.internal:5432/app' "$PASS" | xport --secret --once --name staging-db

Piped stdin plus --secret serves the content as a secret page instead of a plain paste: the recipient sees an explanation first, clicks Reveal secret, and only then receives the content. The secret value is never part of the page markup — it is fetched in the reveal call.

Behaviour

• The content lives in memory only and is never written to disk on your machine or the relay.
• --once (or --burn) deletes the content from memory after the first reveal: reloading or reopening the link shows “This secret is gone.” and the raw endpoint answers 410.
• Without --once the secret can be revealed repeatedly until the session expires or you stop the command.
• The reveal button is the gate; masking and Copy secret help the recipient handle the value safely.
• A persistent --password still applies on top — the relay asks for it before the page even loads.
• 10 MiB size cap (same as every stdin share).

--once and --burn imply --secret: echo x | xport --once shares a one-time secret.

Use cases

• Hand database credentials to a teammate without a chat trail.
• Share an API token with a CI runner someone else operates.
• Send a recovery code to a client who is not on your chat tool.

For anything that must outlive the conversation, use a real secret manager — xPort secrets are transient by design.

Options

All persistent options apply: --name, --expires, --password, --qr, --copy, --detach, --json — plus the stdin-specific --secret, --once, and --burn.