Share a secret. Once.
Your message is encrypted in this browser before it leaves your device. The server only ever stores ciphertext it cannot decrypt.
Your link is ready
Send the link and Challenge Key through separate channels — for example, the link by email and the Challenge Key by phone, SMS, or Signal. This does not make interception impossible, but it means no single intercepted channel is enough on its own.