Create a link that works once, then deletes the secret. It's encrypted in your browser, so the server never sees it.