Kryptid API

Create one-time secrets from scripts, CI pipelines or ticket systems. Kryptid stays zero-knowledge: you encrypt before sending, the API only receives ciphertext, and the decryption key travels in the link's #fragment, which is never sent to any server.

Deutsch: Die API nimmt nur bereits verschlüsselte Daten an. Am einfachsten nutzen Sie die fertige Kommandozeile unten.

1. Quick start with the CLI

Create an API key in your dashboard (approved accounts only), then download kryptid-cli.mjs (Node.js 18+, no dependencies):

export KRYPTID_API_KEY=kr_…
node kryptid-cli.mjs --expires 24 --label "VPN for J. Doe" "s3cr3t-password"
# → https://kryptid.ramzx.de/kryptid/<id>#v=2&key=…

echo "s3cr3t" | node kryptid-cli.mjs --passphrase "told-by-phone" -

2. Authentication & limits

Send Authorization: Bearer kr_…. Keys are shown once and stored only as a hash. Limit: 120 requests per 15 minutes per key. Requests from accounts that are no longer approved return 403.

3. Endpoints

Method	Path	Description
POST	`/api/v1/secrets`	Create a secret (body below). Returns `201 {id, url, expiresAt}`.
GET	`/api/v1/secrets`	Your last 200 secrets (metadata only).
GET	`/api/v1/secrets/{id}`	Status: `pending`, `opened`, `expired` or `revoked`, plus `openedAt` and `failedAttempts`.
DELETE	`/api/v1/secrets/{id}`	Revoke: the link stops working immediately.

4. Request body for POST /api/v1/secrets

{
  "encryptedContent": "<base64 AES-256-GCM ciphertext incl. tag>",
  "iv": "<base64, 12 bytes>",
  "authVerifier": "<base64 SHA-256(authToken), 32 bytes>",
  "expirationHours": 24,          // 0.17 … 720
  "label": "optional, only visible to you"
}

The plaintext is the UTF-8 JSON {"type":"text","content":"…"}. Then build the link yourself: url + "#" + fragment.

Mode	AES key	authToken	Fragment
Key in link	32 random bytes	`SHA-256("kryptid-v2-auth" ‖ key)`	`v=2&key=<base64 key>`
Passphrase	PBKDF2-SHA-256, 300,000 iterations, 16-byte random salt, 64 bytes output: bytes 0–31	bytes 32–63 of the same output	`v=2&pp=1&salt=<base64 salt>`

The server stores only SHA-256(authToken). The recipient's browser derives the same token and gets the ciphertext only with the correct key or passphrase — wrong passphrases never delete the secret, they are throttled.

5. Errors

JSON {"error": "…", "code": "…"} with 400 (invalid input), 401 (key missing/invalid/revoked), 403 (account not approved), 404, 413 (too large, max. ~20 MB), 429 (rate limit).