It seems like this is relying on the server to delete the message when accessed?

I made a pastebin years ago that does similar using an anchor tag for the key, except it doesn’t guarantee deletion. https://paste.sh

I’ve been thinking about making it more secure using service workers (something like a service worker combined with resource signing, so it can be cached in browsers and people have to explicitly “upgrade” — along with the hash of the script shown, which can be verified with a reproducible build from a git revision hash).