How to send an API key securely

The transfer is step two. Scoping is step one, and rotation is step three.

1. Scope before you send

The best protection isn't in how you transmit a key — it's in what the key can do if it leaks anyway. Before sending anything to a contractor or teammate:

• Create a key just for them rather than sharing yours — most platforms (Stripe, AWS, OpenAI, GitHub) support multiple keys or per-user tokens. A dedicated key can be revoked without breaking anything else, and audit logs show whose key did what.
• Grant the minimum — restricted scopes, read-only where possible, sandbox/test mode until production access is actually needed.
• Set an expiry at the provider if it supports one (GitHub fine-grained tokens, AWS temporary credentials).

2. Transfer it without leaving copies

Email and chat retain everything indefinitely — the key ends up in message history, notification previews, backups, and every synced device. GitHub's secret-scanning exists precisely because keys pasted into the wrong place are a top breach vector. Use a transfer that's end-to-end encrypted and read-once:

1. Open shareasecret.io — no account, nothing to install.
2. Paste the key (and only the key — send context like "this is the staging Stripe key" separately, so the secret and its label never travel together).
3. Send the one-time link, or read the short code over a call. Encryption happens in your browser; the server stores only ciphertext, destroyed on first read.
4. Ask them to confirm it works, e.g. a quick curl against the API. The link is now dead — nothing left to leak.

3. Plan the rotation

• Note when the engagement ends and revoke the key that day — calendar it when you create it.
• Prefer short-lived keys re-issued as needed over long-lived ones "to be safe."
• When someone leaves, rotate anything they had, even if you trust them — their machines and accounts remain attack surface.