Developer integrations

Share secrets from the tools where work actually happens

PrivateNote is useful as a website, but developer teams usually need the same encrypted handoff inside editors, local AI agents, scripts, and controlled deployments. This page maps those entry points and the trust boundary behind them.

Which tool to use when

Pick the path closest to where the secret already lives. Every integration uses the same local encryption contract.

Web app

Stable

Paste a secret, choose expiry and read limits, then share the encrypted link from any browser.

PrivateNote web app with encrypted note editor, expiry settings, and Share Private Note button — Web app at privatenote.ai — write a note, customize expiry, attach files, and share from any browser.

Open privatenote.ai → paste secret → share encrypted link

How encryption works

CLI

Stable

Zero-footprint secrets in bash history, pipes, and CI/CD.

$ echo 'sk-live-...' | npx privatenote-cli --expire 1h --output-url-only
https://privatenote.ai/note/a1b2c3d4#…

Pipe a secret into the CLI — encryption runs locally, stdout prints a one-time URL only.

View docs

VS Code & Cursor

Stable

Daily developer flow — sidebar, selection, and clipboard without leaving the editor.

PrivateNote sidebar panel in VS Code or Cursor with title, content, expiry, and burn-after-reading options — Sidebar panel in VS Code or Cursor — compose a note, set expiry and burn-after-reading, then share without leaving the editor.

code --install-extension PrivateNote.privatenote-vscode

View docs

Chrome extension

Stable

Encrypt selected text in place — context menu, popup, and Alt+Shift+P.

# Right-click selected text → Create PrivateNote
# Shortcut: Alt+Shift+P

View docs

MCP server

Stable

Give AI agents a local create_private_note tool for secure handoffs.

// create_private_note
{ "content": "recovery-code-…", "expiresIn": "1h", "burnAfterReading": true }
https://privatenote.ai/note/a1b2c3d4#…

Agents call create_private_note — the MCP process encrypts locally and returns a shareable URL.

View docs

Codex plugin

Stable

MCP plus skills for OpenAI Codex CLI and IDE.

codex mcp add privatenote -- npx -y privatenote-mcp

View docs

Recipes

Common scenarios

Start from the job — pick the integration that matches where the secret lives and how it needs to move.

CLI

Share an API key from CI

Pipe a GitHub Actions secret into the CLI and capture a one-time URL — keep plaintext out of workflow logs.

echo "$API_KEY" | privatenote --output-url-only

View docs

Chrome

Hand off from the browser

Select text in Slack, email, or a ticket and create an encrypted link without opening privatenote.ai first.

Right-click → Create PrivateNote

View docs

MCP

Agent sends a recovery code

Let an MCP client call create_private_note with burn-after-reading when the agent needs a secure handoff.

create_private_note({ burnAfterReading: true })

View docs

VS Code

Share a token from the editor

Highlight env vars, API keys, or connection strings in VS Code or Cursor and hand off without switching apps — the link lands on your clipboard.

Right-click → Share as PrivateNote

View docs

Codex

Give Codex a secure handoff tool

Register the MCP server once so Codex can create encrypted links during agent workflows instead of pasting secrets into chat.

codex mcp add privatenote -- npx -y privatenote-mcp

View docs

Web

Send to someone outside your stack

Use the web app when the recipient only needs a link — set expiry, burn-after-reading, and an optional password in the browser.

Create note → expiry + password → copy link

View docs

Self-hosted preview

What works today: point the CLI and MCP server at your API with PRIVATENOTE_API_BASE_URL, and the VS Code extension with privatenote.apiBaseUrl. A Docker Compose preview (docker-compose.yml) spins up a local web + API stack for evaluation.

npm run self-host:up

Preview only — not a production on-premise runtime. The Chrome extension is hardcoded to privatenote.ai and cannot target a self-hosted API; use CLI (--insecure for local http://), MCP, or VS Code instead. Managed enterprise deployments are on the roadmap — contact us if you want early input.

CLI — PRIVATENOTE_API_BASE_URL MCP — PRIVATENOTE_API_BASE_URL VS Code — privatenote.apiBaseUrl Docker Compose docs Enterprise roadmap

Where it fits

A small tool for high-friction moments

Developer teams still pass around database passwords, recovery codes, API tokens, support handoff details, and customer-specific diagnostics. Those secrets often end up in chat history, ticket comments, pull request threads, or AI prompts because the secure path is too slow.

PrivateNote is meant to make the safer path quick. The integration should feel like creating a link, while the implementation keeps the sensitive text encrypted before it reaches the server.

Trust model

Same contract on every path

Architecture

Encrypt locally → upload ciphertext → key in #fragment

Every integration follows the same boundary. Plaintext never leaves your device unencrypted; the server never receives the decryption key.

Encrypt locally

AES-256-GCM on your device — browser, editor, terminal, or MCP process.

Upload ciphertext

Only encrypted bytes and note metadata (expiry, burn-after-reading) reach the server.

Key in #fragment

The decryption key stays in the URL hash. Browsers do not send fragments in HTTP requests.

privatenote.ai/note/…#key

The plaintext is encrypted locally before upload.
The server stores ciphertext and note metadata, not the decryption key.
The key stays in the URL fragment, which is not sent in HTTP requests.
Read limits and expiry are enforced by the note service.

All integration paths should preserve the same basic contract: create ciphertext locally, upload only what the server needs to store and enforce, then share a link that carries the decryption key outside the request.

How encryption works

Start with the integration closest to the secret

Use the web app for occasional sharing, the editor extension for daily developer work, the CLI for scripts and CI, and MCP when an agent needs a secure handoff primitive.

Install extension Compare all tools