How a farmer sent an API token to their developer

Part 1 of "How Agdir uses SecretDrop" — a series on where an agtech company and its customers actually share secrets.

Agdir gives farms a real API. From Settings → API Tokens in the Agdir dashboard, a farm admin can mint a token and use it to pull their own field data, soil samples, and weather into whatever they like — a custom dashboard, an accounting sync, a contractor's integration.

That's exactly what one farm wanted. They'd hired a freelance developer to build a small dashboard that pulled their field data out of Agdir. The farmer logged in, opened Settings → API Tokens, and clicked create. Agdir handed back a 64-character key — shown once.

Now the awkward part: how do you get that key to your developer?

The normal way, and why it's a problem

The farmer's first instinct was the obvious one: paste it into an email. Or WhatsApp. Or the same thread where they'd been discussing the project.

Here's the trouble with that:

• The key is now permanent. An API token in an email sits in both inboxes forever — and gets backed up, synced across devices, and indexed by search. That token can read the farm's data for as long as it's valid.
• It spreads. Emails get forwarded. Chats get seen on a borrowed or lost phone. The one place a live credential should not be is a place that remembers everything — and email is built to remember everything.
• These tokens matter. Agdir caps a company at three active tokens and expires them. A token is a real key to real data, not a throwaway. It deserves to be handled like one.

What they did instead

The farmer pasted the token into SecretDrop and got back a one-time link. They sent the link to the developer — email was fine, because the link isn't the token.

The developer opened it once, copied the key into their environment variables, and the secret self-destructed. If anyone ever scrolls back through that email thread, they'll find a dead link and nothing else.

The token did exactly one journey — from the farmer's screen to the developer's config — and left no copy behind on the way.

The takeaway

If you mint an API token in Agdir, treat the handoff as carefully as the token itself:

• Send the token as a burn-after-read link, not as text in an email or chat.
• Have the developer store it properly (environment variable or a secrets manager) — never back in a document or message.
• Rotate it if it ever leaks, and delete tokens you're no longer using from Settings → API Tokens.

A token that only ever existed for the seconds it took to paste it into a config file is a token no future breach can find.

---

Next in the series: How Agdir's own team passes vendor credentials around.
Need to send a key or password once and have it disappear? Try SecretDrop — no account needed.