Send an API key without pasting it into chat.
API keys often reach production through the least controlled part of the workflow: a ticket, direct message, terminal argument, or copied email. Treat delivery as part of the secret’s lifecycle.
Use the least powerful credential possible
Create a dedicated token with only the permissions, environment, and lifetime the recipient needs. Never share a root credential when a scoped token can do the job. Record who owns rotation and revocation before delivery.
Keep plaintext out of operational exhaust
Do not place keys in issue trackers, chat messages, shell arguments, build logs, screenshots, or support forms. VanishKey's browser and agent paths encrypt locally. Automated callers should provide secret input over standard input or another non-logged source—not as a command argument.
Complete the handoff
- Verify the recipient and intended system.
- Generate a scoped token with an explicit owner and expiry.
- Create and send the one-time link.
- Ask the recipient to store it in their approved secrets manager.
- Revoke the delivery token when temporary access is complete.
For workloads, avoid human delivery entirely
Production services should normally receive secrets through a managed secrets platform, workload identity, or short-lived federation. A one-time link is useful for exceptional human-to-human or agent-to-human bootstrap delivery, not as a runtime configuration system.
Share the secret—not a permanent copy.
No account. One reveal. One-hour maximum lifetime.