Loading...
Loading...
Transfer OAuth access tokens and refresh tokens securely between team members.
OAuth 2.0 (RFC 6749) splits authorization into two artifacts with sharply different lifetimes, and that asymmetry is why these tokens leak badly. An access token is a short-lived bearer string — roughly 60 minutes on Google, around 90 on Microsoft Graph, an hour on Auth0. A refresh token is its quiet cousin: useless alone, but POSTed to the issuer's token endpoint it mints fresh access tokens silently, often for 90 days (Entra default) until revocation.
Chat substrates are the wrong place for either. JWT-bearer access tokens (RFC 9068) decode in any browser tab, revealing sub, scp, and aud claims over a shoulder. GitHub scans for ghp_, gho_, ghs_, ghu_ prefixes plus Slack's xoxb-, xoxp-, and rotating xoxe.xoxp- patterns, but scanning only fires once a value reaches a public surface. Inside private Teams DMs or Notion pages the same strings persist indefinitely.
PasteOnce slots into the narrow case where a token must cross a human boundary: bootstrapping a CI integration before workload identity is wired, sending a Postman Authorization header mid-debug, or seeding a sandbox connector during a vendor proof-of-concept. Pair every handoff with the RFC 7009 revocation endpoint when work ends, mint at the tightest scope, and prefer device authorization (RFC 8628) when the recipient can complete consent themselves.
Client-side encrypted. We can't see your data.
Your data is encrypted in your browser before it leaves your device.
Messages are automatically deleted after being read once.
We never see your data. Only encrypted blobs pass through our servers.
Links work exactly once. Refresh the page and it's gone forever.
Your sensitive data is encrypted in your browser using AES-256-GCM. The encryption key is generated randomly and never sent to our servers.
Only the encrypted blob is stored in our database, with an automatic expiration time. We literally cannot read your data.
When your recipient opens the link, the encrypted data is fetched and immediately deleted from our servers using an atomic Redis GETDEL. The key in the URL hash decrypts the message in their browser.
RFC 8628 removes human-to-human token transfer entirely. The gh CLI, az login --use-device-code, gcloud auth login --no-launch-browser, and stripe login print a short user_code; the recipient completes consent in their browser and the issuer delivers tokens directly.
Never reshare a token minted for your broader use. Generate a new one with the narrowest set: gmail.readonly instead of mail.modify, repo:status instead of full repo, chat:write only. GitHub fine-grained PATs let you target a single repository.
RFC 7009 defines a uniform revoke endpoint. POST oauth2.googleapis.com/revoke for Google, /oauth/revoke for Auth0, auth.revoke for Slack, DELETE /applications/{client_id}/token for GitHub. Revoke the refresh token explicitly — killing only the access half leaves the refresh re-issuable.
If you are sharing a client_secret next to a token, the integration is using the wrong flow. Public clients — desktop apps, mobile, SPAs, CLIs — should authorize via PKCE (RFC 7636) with code_challenge_method=S256. Reserve secret-bearing flows for backends.
A connector vendor needs a refresh token for your Salesforce sandbox so their integration mints access tokens unattended during a two-week proof-of-concept. The connected app is scoped to one custom object; revocation happens via Setup > Connected Apps OAuth Usage afterward.
A nightly Graph job is failing and the on-call needs to reproduce the call. The platform engineer mints a client-credentials access token scoped to the failing app role only, sends it through PasteOnce on a one-hour TTL, and it expires before standup.
A new ARC runner needs a ghs_ installation token to clone private repos until the GitHub App's long-term private key lands in the secret manager. PasteOnce carries the value to the operator; the bootstrap token is revoked within the hour.
The access token is a bearer string presented to a resource server (the Authorization: Bearer header) and lives roughly an hour. The refresh token goes only to the issuer's token endpoint with grant_type=refresh_token and lives much longer. Treat them as separate handoffs.
Hit the issuer's RFC 7009 endpoint with token_type_hint=refresh_token. Google: POST oauth2.googleapis.com/revoke. Auth0: POST /oauth/revoke. GitHub OAuth Apps: DELETE /applications/{client_id}/token. Pass the refresh token explicitly — revoking only the access half leaves refresh live.
Safer than a chat thread, but the better question is why a human is moving one at all. Confidential clients should fetch the value from a vault — HashiCorp Vault, AWS Secrets Manager, Doppler — at runtime. Public clients should not have one; switch to PKCE.
Sometimes. JWT-bearer access tokens (RFC 9068, common on Entra ID and some Auth0 setups) carry scp or roles claims that decode without verification. Google, GitHub, and Slack issue opaque strings whose grants surface only through introspection (RFC 7662) or a tokeninfo call.