Scope the key, send it once through a link that burns, and rotate it on a schedule.
Most providers let you restrict a key to specific permissions, IPs or environments. A scoped key limits the damage if it leaks and is easier to revoke on its own.
Use the creator below. The key is encrypted in your browser with AES-GCM-256 and the link burns after the first reveal, so nothing usable is left in chat or email.
Slack, email or a ticket is fine for the link. If you add a passphrase, give it by voice or a different channel.
The link works once. The key should go straight into an environment variable store or a vault, never into source control or a shared doc.
Treat every shared key as temporary. On Pro, the audit timeline shows when each link was opened, which makes a rotation list easy to build.
No account needed. Free forever plan.
Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.
One URL. The key after the # stays in the browser and never reaches our servers.
The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.
Browser-side encryption shipped on 29 September 2026. Secrets created before that date were stored as plaintext until they expired, and a file's name, size and type are still visible to us. Read the full security model.
An API key pasted into a channel is exported with the workspace, indexed by search, and visible to everyone who joins later. A one-time link in the same channel is harmless once it has been opened. If your team works in Slack, the LinkPilot Slack app creates the link with a /secret command, and the message shortcut turns a key someone already pasted into a secret link so the original can be deleted.
A whole .env file is text, so it fits in the creator as is. For a file that must keep its exact bytes, such as a service-account JSON or a certificate, attach it from a free account; it is encrypted in your browser and destroyed after the first download. For developers who script this, the CLI, SDK and MCP server create the same encrypted secrets from a terminal or an assistant.
It is the delivery step, not the storage. Keys live in a secrets manager or your platform's environment settings; a one-time link is how a key gets from the person who generated it to the person who needs it, once, with no copy in between.
Pro, $29 a month, adds a passphrase on every secret, a custom expiry date and time, and the audit timeline that records each view, burn and revoke. See plans.