DeadDrop Getting Started: Account, Keys, and First Secret (2026)

Getting started overview

This guide provides a rapid onboarding path for DeadDrop, focusing on the essential steps to create an account, obtain necessary API credentials, and execute a first successful API request. DeadDrop is designed for managing ephemeral secrets, enabling secure, one-time sharing of sensitive information such as API keys, database credentials, or temporary access tokens. While the platform offers a web interface for manual secret management, this guide emphasizes programmatic interaction via its API for integration into automated workflows.

The core process involves:

1. Account Creation: Registering for a DeadDrop account.
2. API Key Generation: Creating and securing API keys within the DeadDrop dashboard.
3. First Secret Creation: Using the API key to programmatically create an ephemeral secret.
4. Secret Retrieval: Programmatically retrieving the created secret.

This process is foundational for integrating DeadDrop into CI/CD pipelines, automated deployment scripts, or secure communication channels. For comprehensive details on DeadDrop's capabilities, refer to the official DeadDrop documentation.

Create an account and get keys

Before making any API calls, you need to establish a DeadDrop account and generate API keys. These keys authenticate your requests and link them to your organization.

1. Sign up for a DeadDrop account

Navigate to the DeadDrop homepage and select the option to sign up. You can choose from the free tier for personal use or small teams (up to 3 users), or one of the paid plans starting at $15/month for additional features and team members, as detailed on the DeadDrop pricing page. Follow the on-screen prompts to complete registration, including email verification.

2. Generate API keys

Once your account is active and you are logged into the DeadDrop dashboard:

1. Locate the 'API Keys' or 'Settings' section, typically found in the user profile or organization settings menu.
2. Click 'Generate New Key' or a similar option. DeadDrop will typically provide you with a pair of keys: a public key (or API key ID) and a secret key.
3. Important: The secret key is usually displayed only once upon creation. Copy and store this key securely immediately. Best practices for secret management, such as using environment variables or dedicated secret stores like Google Cloud Secret Manager or AWS Secrets Manager, are recommended for production environments.
4. Label your API key appropriately (e.g., 'Development API Key', 'CI/CD Integration') for easier management.

Your API keys serve as your credentials for all programmatic interactions with the DeadDrop API. Treat them with the same security considerations as any sensitive authentication token.

Your first request

This section outlines how to make your initial API call to DeadDrop to create and then retrieve a secret. We'll use curl for simplicity, but the principles apply to any HTTP client library in your preferred programming language.

Prerequisites

• Your DeadDrop API Public Key and Secret Key.
• A command-line interface with curl installed.

1. Create a secret

To create a secret, you will send a POST request to the DeadDrop API endpoint, including your secret data and any desired expiration settings. Replace YOUR_PUBLIC_KEY and YOUR_SECRET_KEY with your actual credentials, and YOUR_SECRET_DATA with the information you wish to store.

curl -X POST \
  https://api.deaddrop.io/v1/secrets \
  -H "Content-Type: application/json" \
  -H "X-DeadDrop-Public-Key: YOUR_PUBLIC_KEY" \
  -H "X-DeadDrop-Secret-Key: YOUR_SECRET_KEY" \
  -d '{
        "data": "YOUR_SECRET_DATA",
        "expires_in_seconds": 3600, 
        "retrieval_limit": 1
      }'

Explanation of parameters:

• data: The actual secret string you want to store.
• expires_in_seconds: (Optional) The duration in seconds after which the secret will automatically expire. For example, 3600 means 1 hour.
• retrieval_limit: (Optional) The maximum number of times the secret can be retrieved. A value of 1 makes it a true one-time secret.

A successful response will return a JSON object containing a unique secret_id and a retrieval_url. Store the secret_id as you will need it to retrieve the secret later.

{
  "secret_id": "dd-abcdef1234567890",
  "retrieval_url": "https://api.deaddrop.io/v1/secrets/dd-abcdef1234567890",
  "status": "created"
}

2. Retrieve the secret

Once a secret is created, you can retrieve it using its secret_id. This typically involves a GET request. Remember that if you set a retrieval_limit of 1, the secret will be consumed and deleted after this single retrieval.

curl -X GET \
  https://api.deaddrop.io/v1/secrets/dd-abcdef1234567890 \
  -H "X-DeadDrop-Public-Key: YOUR_PUBLIC_KEY" \
  -H "X-DeadDrop-Secret-Key: YOUR_SECRET_KEY"

A successful response will return the original secret data:

{
  "data": "YOUR_SECRET_DATA",
  "status": "retrieved"
}

If the secret has expired or been retrieved its maximum number of times, subsequent retrieval attempts will fail.

Common next steps

After successfully creating and retrieving your first DeadDrop secret, consider these common next steps to further integrate and optimize your usage:

Explore advanced secret options

• Password Protection: Add an additional layer of security by requiring a password for secret retrieval. This is particularly useful when sharing secrets with non-technical users or over less secure channels.
• Webhook Notifications: Configure webhooks to receive notifications when a secret is created, retrieved, or expires. This can be integrated into monitoring or auditing systems.
• Custom Expiration Policies: Beyond simple time-based expiration, explore more granular controls available in the DeadDrop API for secret lifecycle management.

Integrate with existing workflows

DeadDrop's API is designed for programmatic integration. Consider how to incorporate it into:

• CI/CD Pipelines: Securely pass temporary credentials or sensitive configuration data to build and deployment processes.
• Scripting: Use DeadDrop to exchange secrets between scripts or automated tasks without embedding them directly in code or configuration files.
• Internal Tools: Build custom interfaces or integrations for your team to manage and share secrets more effectively.

Review security best practices

Maintaining strong security is paramount when dealing with secrets:

• API Key Management: Regularly rotate your API keys. Store them in secure locations, such as environment variables, dedicated secret management services (e.g., Firebase Secret Manager), or secure configuration files, rather than hardcoding them.
• Access Control: Implement the principle of least privilege, ensuring that API keys only have the necessary permissions.
• Auditing and Logging: Monitor DeadDrop activity logs to track secret creation, retrieval, and expiration events.

Troubleshooting the first call

Encountering issues during your first API call is common. Here's a quick reference for common problems and their solutions:

If these steps do not resolve your issue, consult the DeadDrop troubleshooting guide or contact DeadDrop support directly.