Mint a one-use grant to reveal a secret

Step one of two. Needs apps:secrets, which does not imply apps:read — mint both if the client also lists items. The grant is single-use, short-lived, and bound to the key that minted it — another key or a browser session cannot consume it, and a revoked key is refused even if it already holds a grant token. A recovery-critical value cannot be revealed with a key at all; the dashboard is the only path, because acknowledging that you saved it is something only a person can do.