You can now require recipients to verify their email before viewing a secret.

When creating a push with Auto-Dispatch recipients, enable Require Email Verification. Recipients must enter their email and a 6-digit one-time code before the payload is revealed.

How it works:

Recipient opens the secret link and enters their email
If the email matches the allowlist, a one-time code is sent
Recipient enters the code to unlock the secret
Non-matching emails see the same interface but receive no code — no information leakage

Security details:

Codes are hashed, single-use, and rate-limited
Failed attempts don't burn view counts
Signed cookies prevent replay after verification
Stacks with passphrases for defense-in-depth
Works for both pushes and requests
Full audit trail of verification events

Account admins can set defaults, enforce verification on all pushes, or leave it as a per-push decision under Policy settings.

Available now for Premium, Pro, and Enterprise plans. Coming to Self-Hosted Pro in the next release.

Blog post with full details: https://docs.pwpush.com/posts/2026-07-15-Authenticated-Recipients-Verify-Who-Views-Your-Secrets/

Authenticated Recipients — Email Verification for Secret Links