Skip to main content
Connect One-Time Secret and when Rallied’s agents deliver a temporary password, a recovery code, or any other sensitive value to an end user, they hand off a single-use link instead of leaving the cleartext value in a ticket note, email thread, or chat log. The recipient opens the link once and the value is destroyed. What you get once it’s connected:
  • No credentials in your ticket history. The agent posts the link, not the password. Your PSA stays clean of anything an auditor would flag.
  • No follow-up cleanup for your team. No more “go back and redact the temp password from ticket #4832” after a reset.
  • One less tool your techs have to reach for. The agent generates the link automatically when it does a password reset or hands off a recovery code — your techs don’t have to remember to use OneTimeSecret manually.
One-Time Secret is configured in MSP Settings → Integrations.

​
Connect One-Time Secret

You’ll need a One-Time Secret account and an API key.
1

Generate an API key in One-Time Secret

Go to onetimesecret.com and sign in (or sign up). The free plan supports the API; paid plans raise the rate limits and add custom branding.From the top-right menu open Account, scroll to the API section, and click Generate Key (or Reset Key if you already have one). Copy the key.
2

Paste the credentials into Rallied

In Rallied, go to MSP Settings → Integrations, find the One-Time Secret card, and click Connect. Fill in:
  • Username (account email) — the email address on your One-Time Secret account.
  • API Key — the key you just copied.
Click Save. The card shows Connected once the credentials check out.
That’s it. There’s no per-tenant or per-client setup, and no webhook to register.

​
What happens when the agent needs to share a credential

When a workflow (or the agent’s own reasoning) calls for delivering something sensitive to a user, like a temporary password after a reset, a recovery code, or a first-login token, the agent generates a one-time link through your One-Time Secret account and puts the link in front of the user instead of the value itself. By default the link expires 24 hours after it’s created. The agent can shorten that for live-call resets or extend it up to 14 days for users who might not open it right away. If the workflow calls for extra protection on high-sensitivity credentials (domain admin, banking portals), the agent can attach a passphrase to the link and deliver the passphrase through a different channel — for example, link goes in the ticket, passphrase gets read out loud on the voice call. The agent uses whichever channel the ticket is already on:
  • PSA ticket — customer-visible reply on the ticket, so the user gets it in the same email thread they’ve been on.
  • Voice agent — link is sent by SMS or email as part of the call handoff.
The cleartext value never lands in the ticket, the transcript, or the chat log.

​
Approval settings

Generating a one-time link is auto-approved by default, so the agent can do it without stopping. If you want a technician to review each link before it goes out, change onetimesecret-share-secret to Needs approval on the integration page. See Approval settings.

​
If something goes wrong

If One-Time Secret returns an error when the agent tries to generate a link (rate limit, expired API key, service outage), the agent does not fall back to pasting the cleartext value on the ticket. It stops, posts an internal note asking a technician to deliver the credential manually, and moves on. Your customer-facing history stays clean even when the API is having a bad day.