Skip to main content
POST — the secret is returned in the body, never in a URL. 403 if locked; 404 if expired. Returns { key, value, expires_at }.