1
What secret sharing does
Overview

Two modes of sharing

EmpowerNow supports two independent sharing mechanisms for secrets. Both let you share a secret value without exposing your full secrets inventory to the recipient.

ModeHow it worksRecipient needs an account?
Time-limited linkGenerates a short URL that reveals only the secret value. The link expires automatically after the configured duration.No β€” anyone with the link can view the value
Grant-based shareGrants a named EmpowerNow user read access to this specific secret. The recipient sees it in their "Shared with me" section.Yes β€” recipient must be an EmpowerNow user
Key behaviours

What gets shared β€” and what doesn't

A share exposes only the value of the secret. The secret's name, path, tags, and other metadata are never visible to the recipient via a share link. For grant-based shares, the recipient can see the secret name in their "Shared with me" list but cannot browse your full secrets tree.

ℹ️
Share vs. direct access

Sharing a secret does not grant the recipient any other access to your secrets. It is a targeted, audited, revocable disclosure of one value β€” not an access grant to the plugin or vault path.

2
Open the Share modal
Navigation

Finding the Share button

The Share button appears in two places: on a secret note card in the My Secrets grid view (hover to reveal the action icons) and on the detail panel of a vault-backed secret in Secrets Hub. Click the 🀝 Share button to open the Share modal.

My Secrets /secrets-notes
SECRET NOTE
Production DB Password
✏️ Edit 🀝 Share πŸ—‘οΈ
SECRET NOTE
Staging API Key
✏️ Edit 🀝 Share πŸ—‘οΈ
+ New Secret
Modal layout

Share modal fields

The Share modal presents both share type options and configuration fields. Select your share type first β€” the form adjusts to show only the relevant fields.

FieldRequiredNotes
Share typeβ˜… YesTime-limited link or Grant-based share
Expiryβ˜… Yes (link)1h, 24h, 7d, or custom date/time. Grant-based shares can have no expiry.
Optional messageNoPlain text note shown to the recipient when they open the share link
Recipient emailβ˜… (grant)Must match an existing EmpowerNow user. Only visible when Grant-based is selected.
4
Grant-based share
Creating a grant

Share with a named EmpowerNow user

Switch the Share type to Grant-based share. The Recipient email field appears. Type the email address of the EmpowerNow user you want to grant access to. The field auto-completes against known users.

Recipient side

How the recipient accesses the shared secret

The recipient receives an in-app notification in their EmpowerNow inbox. The notification shows who shared the secret and includes a link to the "Shared with me" section of My Secrets. Inside Shared with me, the secret appears in a read-only row showing the secret name and value (revealed on click). The recipient can copy the value but cannot edit, delete, or re-share the secret.

πŸ’‘
Grantor can revoke at any time

Grant-based shares remain active until explicitly revoked or the optional expiry is reached. Use the Shares tab on the secret detail panel (see Section 5) to revoke access whenever needed.

5
View active shares & revoke
Shares tab

View all active shares on a secret

Open any secret's detail panel and click the Shares tab. This tab lists every active share associated with the secret β€” both time-limited links and grant-based shares β€” along with their status and expiry.

Production DB Password β€” Shares /secrets-notes/:id/shares
Type Created Expires Recipient Status Actions
πŸ”— Link 2026-04-28 09:14 2026-04-29 09:14 β€” Active Revoke
🎁 Grant 2026-04-27 14:30 No expiry jane.doe@company.com Active Revoke
πŸ”— Link 2026-04-20 11:00 2026-04-21 11:00 β€” Expired β€”
Revocation

Revoke a share

Click Revoke on any active share row. For time-limited links, the URL is immediately invalidated β€” anyone opening it will see a "Share not found or revoked" message. For grant-based shares, the recipient's access is removed immediately; the secret disappears from their "Shared with me" list.

🚫
Revocation is instant and irreversible

You cannot restore a revoked share. If you need to re-share after revoking, create a new share from the Share modal.

ColumnDescription
TypeLink (time-limited URL) or Grant (named user access)
CreatedTimestamp when the share was created
ExpiresExpiry timestamp or "No expiry" for open-ended grants
RecipientEmail address for grant shares; blank for anonymous links
StatusActive (live), Expired (auto-expired), Revoked (manually invalidated)