01
Passwords remain permanently in the chat historyEmail, ticket, chat, and backup keep access credentials longer than the actual project.
For IT service providers, system houses & agencies
Credentials provided. Without passwords in tickets.
Send admin access, API keys and recovery codes as one-time readable messages — manually in the browser or integrated via API and webhooks.
The hidden copies
A secret in the ticketing system is no longer a secret.
02
Customer and service provider share the same channelProtecting the link and password side by side does not protect against a compromised secure inbox.
03
Handovers are not automatedManual copy-and-paste processes waste time and leave send status or returns unclear.
Three operating modes
Send directly, let customers receive, or integrate into your workflow.
1
One-time handover
Encrypt the secret in the browser, verify the recipient address, send and optionally prove access.
2
Customer secure inbox
A fixed link allows customers to submit access details or configuration files securely without needing an account.
3
API & Webhooks
Create a sending, check status, withdraw, and manage contacts. Events are delivered signed.
Integration
From project completion to your own customer portal.
Browser applications: Business API keys have limited rights and optionally approved HTTPS origins. The full secret is displayed only once.
Project handover
CMS, hosting, and DNS access provided once, without recording them in the final audit log.
Support
Customers send temporary access via their personal secure inbox link instead of through a ticket.
Automated dispatch
Your own tools generate secure messages and check whether they are open, read, expired or withdrawn.
Webhook follow-up step
Retrieval, expiry or withdrawal triggers a traceable process within your own system.
Security decision
Convenient or technically blind – the mode is transparent.
Secure mode
The key remains in the URL fragment and is passed on via a separate channel; SchlüsselBot does not receive it technically.
Convenience mode
SchlüsselBot provides the ready-made link. For this, the key passes briefly through the server and is not logged.
API with self-encryption
Hand over ciphertext if the plaintext must not reach SchlüsselBot. The more convenient message field encrypts server-side.
The technical documentation publicly and machine-readably describes endpoints, scopes, CORS, status models, idempotency, and webhook signatures. To developer page.
Frequently asked
Briefly answered
Can I access SchlüsselBot from an external browser app?
Yes, in Business. For each API key, allowed HTTPS origins and scopes are defined.
Which events trigger webhooks?
Among other things, creation, retrieval, withdrawal, expiry, and failed email delivery. Deliveries are signed and repeated in case of errors.
Is SchlüsselBot a password manager?
No. SchlüsselBot transmits secrets only once. Ongoing management and rotation remain the responsibility of your password manager or IAM.
Secrets belong in the target process — not in its communication history.
Start directly in the browser or integrate secure dispatch into your application.