Share an API key or token without leaving it in chat

An API key, an OAuth token, or a webhook secret is not “just another password”. If someone copies it from a Slack thread or an inbox, they can often act on it for months — sometimes before you notice.

Teams still paste them in plain text “just until the other person saves it”. The channel keeps that text long after everyone forgot the conversation.

Why chat and email are a bad home for technical secrets

Like everyday passwords, WhatsApp, Slack, Teams, Discord, and Gmail are built to archive:

• full-text search in history;
• exports, backups, legal hold;
• admin access or a compromised account surfacing old messages.

A Stripe, SendGrid, GitHub, or AWS token in a thread becomes a permanent copy in many places. Revoking the key at the provider does not delete the Slack message.

For human passwords we already covered the risks in how to share a password securely. API keys follow the same logic, often with broader impact (data access, billing, infrastructure).

What works better

1. Never paste the secret in the same message as the link used to read it.
2. Deliver the secret once, then remove it on the server after it is read.
3. Rotate or revoke the key if you suspect a leak — even if the link was already consumed.

With Secret Share, text is encrypted in the browser (AES-256). The server never receives the token in plaintext; the decryption key is in the URL, not in our database. After the recipient opens the link, the encrypted payload is deleted — opening it again returns nothing.

Same idea as a self-destructing message, for a block of text the recipient copies into a secrets manager or an environment file.

Common scenarios

• developer onboarding: temporary token until the first deploy;
• customer support: one-time webhook secret to configure;
• external contractor: scoped key that should not live in a project channel;
• emergency rotation: new key for one person without broadcasting to the whole team.

In practice

1. Paste the key or token on secretshare.eu.
2. Copy only the generated link.
3. Send the link on your usual channel (Slack, email, ticket).
4. The recipient reads, copies into their vault or .env, and the Secret Share message is gone.

New to the product? See what Secret Share is for the full picture.

Get started at secretshare.eu.