SecretSeal — Getting started and help

A clear next step, whenever you need it.

Start with one task. You can add teammates and explore other workflows when you are ready.

After creating an account, open the verification email. Check spam or quarantine if it has not arrived.
Use the newest link. If it has expired or was already used, request a fresh email sign-in link.
Return to your chosen task after signing in. If the workspace is missing, ask its owner to check your invitation.

Team 2FA

Import the client account’s authenticator setup information. Each teammate signs in with their own SecretSeal account, and access follows your workspace policy.

Start with Team 2FA

Send a secret

Share information you already have. Add the content, review who can open it and when it expires, then share the generated link with the intended recipient.

Start a secure send

Secure Request

Ask someone to submit information through a secure link. Protect your decryption key before sharing the request so you can read the response later.

Start a Secure Request

When Team 2FA access is blocked

Waiting for approval: An authorised reviewer needs to decide the request. View its status in Team 2FA; submitting repeated requests will not bypass review.
Device or passkey needed: Follow the device or passkey step shown in your workspace. Use your own account and an authorised device.
Request denied or expired: Check with the workspace owner. Request access again only when appropriate; approval and expiry rules still apply.
A code is not accepted: Check that you selected the right client account and that your device clock is correct. Never send the setup key or code to support.

Team 2FA supports authenticator codes (TOTP). It does not turn SMS or push approval into a shared authenticator, or bypass a client’s access policy.

Retrieve codes through the API

Unattended access is optional for explicitly enabled accounts. An owner or admin creates a workspace API key with the live-code scope, opens the account’s API access settings, selects that key and confirms with a passkey.

Enabling this stores a separately encrypted copy of the authenticator setup key that SecretSeal servers can decrypt to generate codes without your device. Ordinary vault items remain client encrypted. Accounts requiring approval for every code cannot use unattended access.

POST /api/v1/totp/ACCOUNT_ID/code
Authorization: Bearer YOUR_SCOPED_API_KEY