For support desks
Ask customers for a password without it landing in the ticket
When a support agent needs a customer’s login or API key, the customer pastes it into a reply. Now it sits in the ticket history, the email notifications, every agent’s view and every export, long after the issue is closed. Send a one-time request link instead, and the credential goes to one agent’s ShareShield account, nowhere else.
#48213 Sync fails after workspace move
Reply to dana@customer.example
Thanks Dana. So we can reproduce the sync error, I’ll need a read-only API key for your workspace. Please don’t paste it here; use this one-time form, which sends it only to me:
https://app.shareshield.net/request/Xq4tN8vR2mKp7LwY3bZ9d
Mo Adeyemi (mo@support.example) is asking you for a secret
Available for
1 day3 days7 days01The problem
A ticket is the worst place a password can end up
Tickets are built to be kept, searched, shared and exported. That’s what makes them useful, and it’s why a password pasted into one is readable by far more people than the agent who needed it:
- every agent who can see that queue, today and after they’ve moved teams
- your helpdesk administrators, and anyone they give access to
- the email notifications, which put a copy in the customer’s mailbox and in the inbox of anyone CC’d on the ticket
- ticket exports, reports and backups
- every app, bot and AI assistant connected to the helpdesk
- whoever compromises any of those accounts later
Most customers don’t know that. They paste the password because it’s the quickest way to get help.
The fix is to give them a quicker way that doesn’t leave a copy.
02Three replies your agents can use today
Three replies to save as macros
Copy these into your helpdesk as macros or saved replies. Replace the bracketed parts.
Reply 1
When you need a credential from the customer
What the agent doesCreates a secret request in ShareShield for the customer’s email address and pastes the link. The customer doesn’t need an account. Requests last 3 days by default and at most 7.
Thanks, that helps. To look into this I’ll need [the API key for your workspace / a login for a test user]. Please don’t paste it into this ticket. Use this one-time form instead, which sends it only to me: [request link] The form works once and expires in [3 days].Reply 2
When you’re sending the customer something sensitive
What the agent doesSends the temporary password, licence key or recovery code as a one-view secret, emailed to the customer’s address with “Only these recipients can open it” ticked.
I’ve reset the password for [account]. You’ll find it here: [secret link] The link opens once and expires in [24 hours]. If it says the secret has already been viewed and you didn’t open it, tell me straight away and I’ll reset it again.Reply 3
When the customer has already pasted a password
What the agent doesRemoves the password using the helpdesk’s own redaction or delete feature, if it has one, then sends a request link for the new credential. ShareShield can’t remove anything from your helpdesk; that part is up to your helpdesk’s tools.
Thanks. I’ve removed the password from this ticket, but it has been stored in our support system, so please change it now. Next time, use this one-time form and it will come straight to me: [request link]
03Rules for the whole team
Set the defaults once, so agents don’t have to think about them
Secret policy
Rules enforced on every secret your organization creates. Limits can only tighten what your plan allows.
- Expiry: up to 3 days (default 1 day)
- Views: up to 3 (default 1)
- Passcode: optional
- Viewers: anyone with the link
- Secret requests: allowed
Put your support team in a ShareShield organisation, and the owner sets the policy for everyone: the longest a link can last, the default views, whether a passcode is always required, and whether files and requests are allowed. The send form fills in and locks to match. Agents get the member role; team leads get admin.
Admins can see every secret and request their agents have sent (never the contents) and burn any that are still live, which helps when a link goes to the wrong customer.
The audit log records each secret and request with the agent who created it, so a QA review or a customer’s security questionnaire can be answered from a filtered list, not from memory. On Professional and Enterprise, export it as CSV.
04Works with any helpdesk
A link pastes into any reply, and the API is there if you want more
There’s nothing to install in your helpdesk. ShareShield links go into a reply like any other link.
If your team wants a “request credentials” button in its own tools, the API can create secret requests and secrets with a key limited to exactly that. ShareShield doesn’t ship a ready-made helpdesk integration today.
# A key with one scope: requests:create
curl -sS -X POST https://app.shareshield.net/api/v2/requests \
-H "x-api-key: $SHARESHIELD_API_KEY" \
-H "content-type: application/json" \
-d '{"recipientEmail": "dana@customer.example",
"message": "Read-only API key for your workspace, please.",
"expiryDays": 3}'05Which feature does what
Matched to the moments in a ticket
| Moment | Feature |
|---|---|
| You need the customer’s login or API key | Secret request |
| You’re sending a temporary password or licence key | One-view link, emailed to the customer, recipients only |
| A link went to the wrong customer | Burn, by the agent or an admin |
| Every agent should use the same expiry | Enforced organisation policy |
| QA or a customer asks what was sent | Audit log |
| You want it inside your own tooling | API v2, requests:create scope |
06Further reading
Guides for support teams
Put a request link in your next reply instead of “please send the password”
Requests are included on every plan, Free included. Customers only need the link.