The short answer
If you need to hand over a password or API key once, create an encrypted, expiring link and send the link—not the value—in Slack. Start with a short lifetime and one reveal. When access needs to persist, use a shared vault or an individual access grant instead of repeatedly sharing a credential.
SecretBridge.app provides a free browser-based creator and an optional Slack integration. This guide is written by the product's team; it is not an independent review or a claim of endorsement by Slack.
Why not simply paste it into a direct message?
A private conversation is still a conversation record. The value can remain available to the participants, their devices and any retention or export systems that apply to that workspace. Deleting the visible message is not a promise that every copy has disappeared. Encryption in transit protects a connection; it does not set an expiry on the message's contents.
An expiring link reduces how long the handoff can be used and avoids putting the plaintext into conversation history. It does not make an untrusted person trustworthy, prevent screenshots or secure a compromised device.
A browser-to-Slack handoff in five steps
- Open the SecretBridge creator and paste the value. Use a temporary credential with the narrowest permissions possible.
- Keep the default ten-minute lifetime and one reveal, or choose limits appropriate for the recipient's availability. More reveals mean more opportunities to open the link.
- For a higher-risk handoff, add an optional passphrase and arrange to send it through a different channel.
- Create the link and copy the complete result, including the part after
#. For public browser links, that fragment derives the access and decryption material in the browser. - Send the link to the intended person in Slack. Confirm who received it, and revoke or rotate the original credential when the task is complete.
The complete browser link is an access credential. Anyone who gets it may be able to reveal the secret. An optional passphrase adds a separate requirement; the From and Recipient labels alone do not verify identity.
Use a receive channel when Slack identity matters
After installing SecretBridge, the recipient can run /secretbridge expect and share the resulting opaque receive ID with the sender. The sender enters that ID under Options in the web creator. SecretBridge sends a reveal notification to the receiving platform rather than publishing a directory of your organisation's users.
Receiving is free. Each verified platform user gets one free receive-channel creation per UTC calendar month; a paid Sender seat adds further channel creation and platform sending. Workspace administrator approval may be required to install the app. See the current pricing and seat rules.
The reveal boundary is different from an anonymous link. A protected platform reveal verifies platform identity and can involve server-side decryption. If the receiving device is enrolled for device-only encryption, the web handoff can instead use that device's key. Do not assume every Slack card is end-to-end encrypted: choose the flow that matches your requirements and read the security model.
Will link previews consume the secret?
Opening a SecretBridge page or fetching its card is not the same operation as an authorised reveal. The reveal action enforces expiry, access checks and the selected limit. Still, a full capability link should be treated as sensitive even when a preview does not expose its value. Avoid sharing real links with support forms, screenshots or automated review tools.
When a link is the wrong tool
For everyday team access, use a password manager, service-account permissions or a provider's own invitation flow. For recovery phrases, signing keys and other high-consequence material, consider whether transferring the root credential is necessary at all. Expiry cannot undo a recipient's retained copy, and a service's burn policy cannot rotate an external password for you.
For a closer look at the link boundary, read what one-time secret links protect—and what they do not.