Developer API

Build one-time secrets into anything.

Create and manage SelfDestruct.Click links from your own applications. Generate an API key from your account, then send it as a Bearer token.

Quick start

Authorization: Bearer sdc_your_api_key
Content-Type: application/json

API keys belong to your account and inherit your Free or Premium capabilities and limits. The secret content is accepted when a link is created but is never returned by metadata endpoints.

PHP

$payload = json_encode([
    'content' => 'Temporary database password: example',
    'label'   => 'Database password for contractor',
    'expiry'  => 'custom',
    'expiry_at' => '2026-09-01T18:30:00+01:00',
    'password' => 'share-this-separately',
    'tracking' => true
]);

$ch = curl_init('https://selfdestruct.click/api/v1/links');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer sdc_your_api_key',
        'Content-Type: application/json'
    ],
    CURLOPT_POSTFIELDS => $payload
]);

$response = json_decode(curl_exec($ch), true);
echo $response['data']['url'];

JavaScript / Node.js

const response = await fetch('https://selfdestruct.click/api/v1/links', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sdc_your_api_key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    content: 'Temporary Wi-Fi password: example',
    label: 'Guest Wi-Fi',
    expiry: '24h',
    password: 'share-this-separately',
    tracking: true
  })
});

const link = await response.json();
console.log(link.data.url);

cURL

curl -X POST https://selfdestruct.click/api/v1/links \
  -H "Authorization: Bearer sdc_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"content":"Temporary secret","label":"Deployment credential","expiry":"7d","password":"share-this-separately"}'

Endpoints

POST/api/v1/linksCreate a link

GET/api/v1/linksList your links

GET/api/v1/links?q=...Search label or ID

GET/api/v1/links/{id}Retrieve metadata

DELETE/api/v1/links/{id}Delete a link

Premium creation options: expiry accepts never, 1h, 24h, 7d, 30d, 90d or custom. For custom, send expiry_at as an ISO-8601 date/time with timezone. password adds reveal protection (minimum 4 characters), and tracking records successful access time.

Free API behaviour: you may send the same payload shape for every account. If the API key belongs to a Free account, Premium-only fields such as expiry, expiry_at, password and tracking are silently ignored; the link is created using normal Free-account rules.

The password is accepted only when the link is created and is never returned by the API. Send it to the recipient separately from the one-time URL.