Where API keys leak
- Chat history and shared channels.
- Support tickets and issue trackers that many people can read.
- Email threads that get forwarded or archived.
- Shared documents and screenshots.
A safer way to hand over a key
- Create a one-time link for the key, with a short expiry.
- Send the link to the one person who needs it.
- Have them store the key in a secrets manager or environment variable, not in code.
- Rotate the key if you suspect the link was opened by someone else.
Good habits for credentials
- Give each person or service its own key so access can be revoked individually.
- Use the least privilege the task needs.
- Never commit keys to a repository.
- Rotate keys on a schedule and when people leave.
Requesting a secret from someone else
If a client or colleague needs to send you a credential, create a secret request. They receive a link to submit the secret, and you get access to it without it passing through email.
Frequently asked questions
Is it safe to send an API key over Slack?
It is not recommended, because the message stays in the workspace history and may be visible to admins, integrations and exports. Use a one-time link instead.
How do I share credentials with a client?
Create a one-time link with a passphrase, or send the client a secret request so they can submit credentials to you without using email.
Share a secret now
Create a one-time, self-destructing link in seconds. No account needed.
Create a secret link