REST API

Base path

https://secret.streamcode.gr/api/secrets

There is no API key: possession of the raw token (or a valid OTP grant cookie) is the credential.

POST /api/secrets — Create secret

Request body is JSON. The response returns the raw token and a ready-to-share URL. expiresAt must be an ISO-8601 instant within the configured maximum TTL (see application configuration). The web UI labels deadlines in Greece time for readability; the stored value is still a single UTC-based instant.

Example create (adjust expiresAt to be within max TTL)

curl -sS -X POST https://secret.streamcode.gr/api/secrets \
  -H 'Content-Type: application/json' \
  -d '{"payload":"hello","contentType":"TEXT","expiresAt":"2026-05-08T12:00:00Z","maxViews":1,"burnAfterRead":false,"otpEnabled":false,"notifyOnOpen":false,"notifyOnExpiration":false}'

GET /api/secrets/<token> — Reveal secret

Returns plaintext when all checks pass. If OTP is enabled, complete the OTP flow first so the server sets the ots_grant cookie (or pass the grant value if you manage cookies manually).

curl -sS https://secret.streamcode.gr/api/secrets/<token>

POST /api/secrets/<token>/otp — Verify OTP

POST a JSON body with a 6-digit code. On success, the response sets the HttpOnly ots_grant cookie.

curl -sS -X POST https://secret.streamcode.gr/api/secrets/<token>/otp \
  -H 'Content-Type: application/json' \
  -d '{"code":"123456"}'

Prefer a JSON string for code. A JSON number is also accepted and is zero-padded to 6 digits (so codes with a leading zero still verify when clients coerce to number).

Typical HTTP statuses

• 200 — Success
• 401 — OTP required or invalid
• 404 — Unknown token (or intentionally indistinguishable cases)
• 410 — Expired, consumed, policy violation, or view limit reached
• 429 — Rate limited