A paste that burns
Write something and get a link. The text is encrypted in this browser before it leaves: the server stores ciphertext and the key rides in the link's #fragment, which never travels to the server.
The link
Whoever holds this link can read the paste. It is the only copy of the key.
Delete token (shown once, only this browser has it):
You can also delete the paste from the console while you are signed in.
What "one-time" means here. A one-time paste is handed out once. The read that returns it also blanks the stored ciphertext, in the same statement; every later reader is told it is gone (410). It expires on its timer whether or not anyone reads it. The server cannot take back a copy a reader kept.
Not a safe. The server cannot read a paste back to you, so it cannot recover one either. Losing the link or its key loses the text. Do not use this as the only copy of anything you need, and do not use it to store account data: passwords, recovery codes, keys.