Store a secret (API key, webhook payload, signed URL) encrypted with WebCrypto AES-256-GCM and share a claim URL that yields the secret exactly once. A Durable Object serializes reads so single-use delivery is race-free, and every burn returns an Ed25519-signed attestation. Creating a vault requires x402 payment; the recipient's claim read (GET /v/:vault_id) is free.