Burn Notes & Dead Drops: Share One-Time Secrets with a Free API

Some agent workflows need to hand off a temporary invite link, setup token, or message that should stop being readable after a small number of views. Agent Media Tools provides two free endpoints for that access pattern: burn notes, which become unavailable after a configured view count or expiry, and dead drops, messages that can be claimed once and optionally protected with a passphrase. Both are HTTPS calls, work without an API key for basic use, and are exposed as MCP tools.

Why one-time secrets beat a shared paste

A normal paste keeps serving the same content. Burn notes and dead drops instead enforce an access limit at the read endpoint: a burn note stops rendering after its view threshold or expiry, and a dead drop refuses a second successful claim. That reduces accidental re-use, but it is not secure deletion, end-to-end encryption, or a secrets vault.

Burn notes: self-destructing messages

A burn note is created with a single POST and read through a shareable URL. By default the content is rendered once; later requests receive 410 Gone. The database row is removed when a later request observes that the view limit or expiry has already been reached, so describe this as access-limited rather than immediate secure deletion.

curl -X POST https://agentmediatools.com/api/burn-note \
  -H "Content-Type: application/json" \
  -d '{"content": "Invite: https://example.com/team/join?code=abc123", "max_views": 1}'

{"success": true, "slug": "xK4mPqR7tWzB", "url": "https://agentmediatools.com/burn/xK4mPqR7tWzB"}

Hand the url to your recipient. The note page shows how many reads remain. After the configured count is exhausted, the next request returns HTTP 410 Gone and removes the row; an expired note is likewise removed when requested.

You can also give a note a time limit and more than one view. Content is capped at 100 KB and max_views is capped at 10:

curl -X POST https://agentmediatools.com/api/burn-note \
  -H "Content-Type: application/json" \
  -d '{"content": "Staging DB password (rotate after use): p@ss-example-4921", "max_views": 3, "expires_in_hours": 24}'

Dead drops: one-time claims with a passphrase

Dead drops take the pattern one step further. The message is claimed — the first read is the only read — and you can require a passphrase so that even someone holding the URL cannot retrieve the message. The claim endpoint returns JSON, which makes it easy to call from code.

curl -X POST https://agentmediatools.com/api/dead-drop \
  -H "Content-Type: application/json" \
  -d '{"message": "webhook secret: whsec_example_9f2c", "passphrase": "round-trip-42"}'

{"success": true, "slug": "qZ8vL2nMx5kPwR3c", "claim_url": "https://agentmediatools.com/api/dead-drop/qZ8vL2nMx5kPwR3c"}

curl "https://agentmediatools.com/api/dead-drop/qZ8vL2nMx5kPwR3c?passphrase=round-trip-42"

{"success": true, "message": "webhook secret: whsec_example_9f2c"}

Details that matter:

• The passphrase can be sent as a query parameter or as an x-passphrase header.
• A wrong passphrase returns 404 "Dead drop not found" — the endpoint deliberately does not reveal whether a drop exists.
• A second claim returns 410 "This message has already been claimed". The message is no longer available through the claim endpoint, although this is not a secure-erasure guarantee.
• Messages are capped at 50 KB. The API accepts either message or content as the body field.

Python examples with requests

The same endpoints work from any HTTP client. Here is the whole flow in Python using the requests library:

import requests

# Burn note — readable exactly once
note = requests.post(
    "https://agentmediatools.com/api/burn-note",
    json={"content": "One-time setup instructions for the reviewer", "max_views": 1},
).json()
print(note["url"])  # share this exactly once

# Dead drop — passphrase-protected, single claim
drop = requests.post(
    "https://agentmediatools.com/api/dead-drop",
    json={"content": "rotate-me-please", "passphrase": "correct-horse-example"},
).json()

claimed = requests.get(drop["claim_url"], params={"passphrase": "correct-horse-example"})
print(claimed.json()["message"])  # "rotate-me-please"

# Second claim fails — the endpoint refuses another read
again = requests.get(drop["claim_url"], params={"passphrase": "correct-horse-example"})
print(again.status_code)  # 410

This is useful for scripts that need one successful claim. Pass the claim URL through a separate channel and add a passphrase when appropriate. A later request cannot retrieve the message through the claim endpoint, although the stored row is not documented as immediate secure deletion.

Using burn notes and dead drops from an AI agent

Both features are exposed as MCP tools, so a connected agent can create them as part of a workflow without writing HTTP code. The exact tool names are create_burn_note and create_dead_drop. A tool call looks like any other MCP invocation:

{
  "name": "create_dead_drop",
  "arguments": {
    "content": "Final report is at https://example.com/reports/q3.pdf",
    "passphrase": "handoff"
  }
}

The MCP wrapper for create_burn_note exposes content (the default one-view limit applies), and create_dead_drop exposes content plus an optional passphrase. These wrappers provide the same access-limited handoff behavior as the REST endpoints.

A practical workflow: an orchestrator writes a short-lived download link into a passphrase-protected dead drop, then sends the claim URL and passphrase through separate channels. The recipient can claim it once. Rotate or expire the underlying credential independently; do not treat the drop as proof that every copy was erased.

Honest security boundaries

These endpoints enforce limited reads; they do not provide end-to-end encryption or documented secure-erasure guarantees. Content is stored server-side, and a claimed dead-drop row remains stored with its claimed flag. Treat the feature as an access-control convenience:

• Use burn notes and dead drops for short-lived values — setup links, temp tokens, one-time credentials — not for long-term storage.
• Always set a passphrase on dead drops when the content is sensitive. The passphrase is checked server-side before the message is released.
• Rotate or revoke anything you hand off once the handoff is done. A later request cannot retrieve an exhausted note through the read endpoint, but the recipient may have copied the value.
• Both endpoints are callable without an API key and are subject to the same free-tier rate limits as the rest of the platform. If you need higher volume, an agent key is the supported path.

Burn notes and dead drops are part of the free utilities in the Agent Media Tools toolbox — the same API surface used by pastebin, short URLs, and webhook inboxes. You can create and test both in the browser, then move the exact same calls into your agent.