---
title: "How to Share API Keys Securely With a Developer"
url: https://uselinkpilot.com/share-api-keys-securely
description: "How to share API keys securely: scope the key, send it through a one-time link that burns after one view, and rotate it. Works for a whole .env file too."
lang: en
---

# How to share API keys securely

Scope the key, send it once through a link that burns, and rotate it on a schedule.

## Step by step

1. 1
   ### Create a key with the narrowest scope the task allows
   Most providers let you restrict a key to specific permissions, IPs or environments. A scoped key limits the damage if it leaks and is easier to revoke on its own.
2. 2
   ### Paste the key into a one-time link
   Use the creator below. The key is encrypted in your browser with AES-GCM-256 and the link burns after the first reveal, so nothing usable is left in chat or email.
3. 3
   ### Send the link, and the passphrase by another route on Pro
   Slack, email or a ticket is fine for the link. If you add a passphrase, give it by voice or a different channel.
4. 4
   ### Have the developer store it in a secrets manager
   The link works once. The key should go straight into an environment variable store or a vault, never into source control or a shared doc.
5. 5
   ### Rotate on a schedule and when people leave
   Treat every shared key as temporary. On Pro, the audit timeline shows when each link was opened, which makes a rotation list easy to build.

## Send it with a one-time link

No account needed. Free forever plan.

## How it works

1. 01
   ### Paste a password, a key, or a file
   Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.
2. 02
   ### Send the link
   One URL. The key after the # stays in the browser and never reaches our servers.
3. 03
   ### The stored secret is gone
   The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.

Browser-side encryption shipped on 29 September 2026. Secrets created before that date were stored as plaintext until they expired, and a file's name, size and type are still visible to us. Read the full security model (https://uselinkpilot.com/security-architecture).

## Send an API key without leaving it in Slack

An API key pasted into a channel is exported with the workspace, indexed by search, and visible to everyone who joins later. A one-time link in the same channel is harmless once it has been opened. If your team works in Slack, the LinkPilot Slack app (https://uselinkpilot.com/slack) creates the link with a /secret command, and the message shortcut turns a key someone already pasted into a secret link so the original can be deleted.

## Share a .env file or a config

A whole `.env` file is text, so it fits in the creator as is. For a file that must keep its exact bytes, such as a service-account JSON or a certificate, attach it from a free account; it is encrypted in your browser and destroyed after the first download. For developers who script this, the CLI, SDK and MCP server (https://uselinkpilot.com/developers) create the same encrypted secrets from a terminal or an assistant.

## What a one-time link does not replace

It is the delivery step, not the storage. Keys live in a secrets manager or your platform's environment settings; a one-time link is how a key gets from the person who generated it to the person who needs it, once, with no copy in between.

## Frequently asked questions

### Is it safe to send an API key through a link in Slack?

### Can I share a key with someone outside my company?

### Should I share production keys at all?

### Can I automate this?

Pro, $29 a month, adds a passphrase on every secret, a custom expiry date and time, and the audit timeline that records each view, burn and revoke. See plans (https://uselinkpilot.com/pricing).

## Related

- Share credentials securely: https://uselinkpilot.com/share-credentials-securely
- Best way to share passwords with a team: https://uselinkpilot.com/share-passwords-with-team
- Send a password securely: https://uselinkpilot.com/send-password-securely
- CLI, SDK and API for developers: https://uselinkpilot.com/developers

All use cases: https://uselinkpilot.com/use-cases

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://uselinkpilot.com/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Use cases",
        "item": "https://uselinkpilot.com/use-cases"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "How to share API keys securely",
        "item": "https://uselinkpilot.com/share-api-keys-securely"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "Is it safe to send an API key through a link in Slack?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes, because the link reveals the key once and then burns. The message that remains in Slack leads to a burned page. The key itself should never be pasted into the channel."
        }
      },
      {
        "@type": "Question",
        "name": "Can I share a key with someone outside my company?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes. The recipient needs only a browser. Use a scoped key with a short expiry on the link, and rotate the key when the engagement ends."
        }
      },
      {
        "@type": "Question",
        "name": "Should I share production keys at all?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "As rarely as possible. Prefer per-person or per-service keys issued by the provider. When a shared key is unavoidable, send it once through a one-time link and rotate it on a schedule."
        }
      },
      {
        "@type": "Question",
        "name": "Can I automate this?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes. The CLI and SDK encrypt the secret on your machine before sending, and the REST API accepts the ciphertext they produce. API keys for LinkPilot itself are on every plan, including Free."
        }
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "HowTo",
    "name": "How to share API keys securely",
    "description": "Scope the key, send it once through a link that burns, and rotate it on a schedule.",
    "step": [
      {
        "@type": "HowToStep",
        "position": 1,
        "name": "Create a key with the narrowest scope the task allows",
        "text": "Most providers let you restrict a key to specific permissions, IPs or environments. A scoped key limits the damage if it leaks and is easier to revoke on its own."
      },
      {
        "@type": "HowToStep",
        "position": 2,
        "name": "Paste the key into a one-time link",
        "text": "Use the creator below. The key is encrypted in your browser with AES-GCM-256 and the link burns after the first reveal, so nothing usable is left in chat or email."
      },
      {
        "@type": "HowToStep",
        "position": 3,
        "name": "Send the link, and the passphrase by another route on Pro",
        "text": "Slack, email or a ticket is fine for the link. If you add a passphrase, give it by voice or a different channel."
      },
      {
        "@type": "HowToStep",
        "position": 4,
        "name": "Have the developer store it in a secrets manager",
        "text": "The link works once. The key should go straight into an environment variable store or a vault, never into source control or a shared doc."
      },
      {
        "@type": "HowToStep",
        "position": 5,
        "name": "Rotate on a schedule and when people leave",
        "text": "Treat every shared key as temporary. On Pro, the audit timeline shows when each link was opened, which makes a rotation list easy to build."
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "SoftwareApplication",
    "@id": "https://uselinkpilot.com/#software",
    "name": "LinkPilot",
    "applicationCategory": "BusinessApplication",
    "operatingSystem": "Web",
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "url": "https://uselinkpilot.com",
    "offers": [
      {
        "@type": "Offer",
        "name": "Free",
        "price": "0",
        "priceCurrency": "USD",
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Pro",
        "price": "29",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "29",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency",
        "price": "299",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "299",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency Plus",
        "price": "799",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "799",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Pro (yearly)",
        "price": "288",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "288",
          "priceCurrency": "USD",
          "billingDuration": "P1Y"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency (yearly)",
        "price": "2988",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "2988",
          "priceCurrency": "USD",
          "billingDuration": "P1Y"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency Plus (yearly)",
        "price": "7980",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "7980",
          "priceCurrency": "USD",
          "billingDuration": "P1Y"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Enterprise",
        "priceSpecification": {
          "@type": "PriceSpecification",
          "priceCurrency": "USD"
        },
        "url": "https://uselinkpilot.com/pricing"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://uselinkpilot.com/#organization",
    "name": "LinkPilot",
    "alternateName": "LinkPilot by TetraCore",
    "url": "https://uselinkpilot.com",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "support@uselinkpilot.com",
      "url": "https://uselinkpilot.com/support"
    },
    "parentOrganization": {
      "@type": "Organization",
      "@id": "https://tetracorehq.com/#organization",
      "name": "TetraCore",
      "url": "https://tetracorehq.com/"
    },
    "logo": {
      "@type": "ImageObject",
      "url": "https://uselinkpilot.com/logo-512.png",
      "width": 512,
      "height": 512
    },
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "sameAs": [
      "https://x.com/uselinkpilot",
      "https://www.linkedin.com/company/uselinkpilot",
      "https://facebook.com/uselinkpilot",
      "https://github.com/TetraCoreHQ/linkpilot-cli",
      "https://github.com/TetraCoreHQ/linkpilot-mcp",
      "https://www.npmjs.com/package/linkpilot",
      "https://www.npmjs.com/package/@uselinkpilot/sdk",
      "https://www.npmjs.com/package/@uselinkpilot/mcp",
      "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad",
      "https://addons.mozilla.org/en-US/firefox/addon/uselinkpilot/"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "name": "LinkPilot",
    "url": "https://uselinkpilot.com",
    "potentialAction": {
      "@type": "SearchAction",
      "target": "https://uselinkpilot.com/blog?q={search_term_string}",
      "query-input": "required name=search_term_string"
    }
  }
]
```