[{"data":1,"prerenderedAt":223},["ShallowReactive",2],{"blog-/en/blog/how-to-share-an-api-key-securely":3},{"id":4,"title":5,"alternate_path":6,"author":7,"body":8,"date":212,"description":213,"draft":214,"extension":215,"locale":216,"meta":217,"navigation":218,"path":219,"seo":220,"stem":221,"__hash__":222},"blog/blog/how-to-share-an-api-key-securely.md","Share an API key or token without leaving it in chat","/blog/partager-une-cle-api-en-securite","Rémy Sainsard",{"type":9,"value":10,"toc":204},"minimark",[11,32,39,44,51,64,71,84,88,109,127,135,139,153,157,185,193,196],[12,13,14,15,19,20,23,24,27,28,31],"p",{},"An ",[16,17,18],"strong",{},"API key",", an ",[16,21,22],{},"OAuth token",", or a ",[16,25,26],{},"webhook secret"," is not “just another password”. If someone copies it from a Slack thread or an inbox, they can often act on it ",[16,29,30],{},"for months"," — sometimes before you notice.",[12,33,34,35,38],{},"Teams still paste them in plain text “just until the other person saves it”. The channel ",[16,36,37],{},"keeps"," that text long after everyone forgot the conversation.",[40,41,43],"h2",{"id":42},"why-chat-and-email-are-a-bad-home-for-technical-secrets","Why chat and email are a bad home for technical secrets",[12,45,46,47,50],{},"Like everyday passwords, WhatsApp, Slack, Teams, Discord, and Gmail are built to ",[16,48,49],{},"archive",":",[52,53,54,58,61],"ul",{},[55,56,57],"li",{},"full-text search in history;",[55,59,60],{},"exports, backups, legal hold;",[55,62,63],{},"admin access or a compromised account surfacing old messages.",[12,65,66,67,70],{},"A Stripe, SendGrid, GitHub, or AWS token in a thread becomes a ",[16,68,69],{},"permanent copy"," in many places. Revoking the key at the provider does not delete the Slack message.",[12,72,73,74,79,80,83],{},"For human passwords we already covered the risks in ",[75,76,78],"a",{"href":77},"/en/blog/how-to-share-a-password-securely","how to share a password securely",". API keys follow the same logic, often with ",[16,81,82],{},"broader"," impact (data access, billing, infrastructure).",[40,85,87],{"id":86},"what-works-better","What works better",[89,90,91,97,103],"ol",{},[55,92,93,96],{},[16,94,95],{},"Never paste the secret in the same message as the link"," used to read it.",[55,98,99,102],{},[16,100,101],{},"Deliver the secret once",", then remove it on the server after it is read.",[55,104,105,108],{},[16,106,107],{},"Rotate or revoke"," the key if you suspect a leak — even if the link was already consumed.",[12,110,111,112,118,119,122,123,126],{},"With ",[75,113,117],{"href":114,"rel":115},"https://secretshare.eu",[116],"nofollow","Secret Share",", text is ",[16,120,121],{},"encrypted in the browser"," (AES-256). The server never receives the token in plaintext; the decryption key is in the URL, not in our database. After the recipient opens the link, the encrypted payload is ",[16,124,125],{},"deleted"," — opening it again returns nothing.",[12,128,129,130,134],{},"Same idea as a ",[75,131,133],{"href":132},"/en/blog/self-destructing-message","self-destructing message",", for a block of text the recipient copies into a secrets manager or an environment file.",[40,136,138],{"id":137},"common-scenarios","Common scenarios",[52,140,141,144,147,150],{},[55,142,143],{},"developer onboarding: temporary token until the first deploy;",[55,145,146],{},"customer support: one-time webhook secret to configure;",[55,148,149],{},"external contractor: scoped key that should not live in a project channel;",[55,151,152],{},"emergency rotation: new key for one person without broadcasting to the whole team.",[40,154,156],{"id":155},"in-practice","In practice",[89,158,159,167,174,177],{},[55,160,161,162,166],{},"Paste the key or token on ",[75,163,165],{"href":114,"rel":164},[116],"secretshare.eu",".",[55,168,169,170,173],{},"Copy ",[16,171,172],{},"only"," the generated link.",[55,175,176],{},"Send the link on your usual channel (Slack, email, ticket).",[55,178,179,180,184],{},"The recipient reads, copies into their vault or ",[181,182,183],"code",{},".env",", and the Secret Share message is gone.",[12,186,187,188,192],{},"New to the product? See ",[75,189,191],{"href":190},"/en/blog/what-is-secret-share","what Secret Share is"," for the full picture.",[194,195],"hr",{},[12,197,198,199,166],{},"Get started at ",[16,200,201],{},[75,202,165],{"href":114,"rel":203},[116],{"title":205,"searchDepth":206,"depth":206,"links":207},"",2,[208,209,210,211],{"id":42,"depth":206,"text":43},{"id":86,"depth":206,"text":87},{"id":137,"depth":206,"text":138},{"id":155,"depth":206,"text":156},"2026-10-22","API keys, OAuth tokens, webhook secrets: why Slack and email keep them too long, and how a one-time link helps.",false,"md","en",{},true,"/blog/how-to-share-an-api-key-securely",{"title":5,"description":213},"blog/how-to-share-an-api-key-securely","SaitWcLtI1A7sTYvem-N2NfzdCNrM5NEorPoqDBXdBE",1793087691547]