How to Share API Keys Safely With Your Team
Every developer team needs to share API keys at some point. A new team member joins and needs the Stripe test key. A contractor needs temporary access to the staging database. A deploy requires the production signing secret. The question is never whether you will share keys, but how you will share them without creating a security incident.
The default behavior in most teams is to paste the key in Slack, email it, or drop it in a shared Google Doc. Each of these methods creates a permanent, searchable, unencrypted copy of the secret in a system you do not control. This guide covers every secure alternative and helps you build a sharing workflow that eliminates plaintext key exposure.
Why Slack, Email, and Chat Are Never Safe
Messaging platforms are designed to be searchable, persistent, and accessible across devices. These are the exact properties you do not want for a shared secret.
Slack
- Message retention. Slack stores messages indefinitely on paid plans. A key shared in a DM two years ago is still searchable by any workspace admin.
- Export and compliance. Workspace admins can export all messages, including DMs, on Enterprise Grid plans. Your API key becomes part of a compliance archive.
- Third-party integrations. Slack apps with message read permissions can access your key. If your workspace has a chatbot, analytics tool, or workflow automation with broad permissions, it can read your secret.
- Screen captures and notifications. Desktop and mobile notifications display message previews. A key pasted in a DM may appear in a notification on an unlocked phone sitting on a conference room table.
- Stored in perpetuity. Emails are archived, backed up, and indexed. Even deleted emails persist in backup systems for years.
- Transit encryption is optional. Not all email servers enforce TLS. Your API key may travel in plaintext between mail servers.
- Forwarding and auto-forwarding. An email containing a key can be forwarded to anyone. Auto-forward rules may send it to external accounts without your knowledge.
- Search indexing. Email providers index message content for search. Your API key is now a searchable string in a system you do not control.
Google Docs and Notion
- Link sharing. A shared document with API keys is one permission misconfiguration away from being accessible to anyone with the link.
- Version history. Even if you delete the key from the document, it persists in the version history indefinitely.
- No access revocation. You cannot revoke access to a secret someone has already read from a document. They may have copied it, screenshotted it, or saved it locally.
Ephemeral Secret Sharing
The safest way to share a secret one time is through a service that creates a self-destructing link. The link works once, then the secret is deleted permanently.
1Password Send
If your team uses 1Password, the Send feature creates an encrypted link that expires after a set time or after being viewed. The secret is encrypted end-to-end and never stored in chat history.
Doppler Share
Doppler's share feature generates a one-time-view link with optional password protection. It integrates with Doppler's secret management platform, so the shared secret can be part of an audited workflow.
PrivateBin and Pastebin alternatives
Self-hosted alternatives like PrivateBin encrypt data client-side before uploading. The server never sees the plaintext. The decryption key is part of the URL fragment (after the #), which is not sent to the server. Links can be set to expire after one view.
# Self-host PrivateBin for your team
docker run -d -p 8080:8080 privatebin/nginx-fpm-alpine
# Or use the CLI for quick sharing
echo "sk_live_your_key_here" | pb create --expire 1h --burn
Age encryption for file-based sharing
The age encryption tool is a modern replacement for GPG. You can encrypt a secret to a teammate's public key, and only they can decrypt it. Share the encrypted file through any channel since the ciphertext is useless without the private key:
# Encrypt for a specific team member
echo "sk_live_xxx" | age -r age1teammate_public_key... > secret.age
# They decrypt with their private key
age -d -i key.txt secret.age
Team Vaults and Secret Managers
For ongoing key sharing (not just one-time transfers), a team vault eliminates the need to share keys at all. Team members access the keys they need from a central, access-controlled store.
1Password Teams / Business
Create shared vaults organized by project or environment. Each vault has its own access controls. Team members who need the Stripe production key access it from the shared vault. When someone leaves the team, you revoke their vault access and rotate the keys they had access to.
Doppler
Doppler organizes secrets by project and environment. Developers access dev secrets automatically. Production secrets require elevated permissions. The platform injects secrets directly into your deployment pipeline, so developers never need to download production keys to their machines.
Infisical
Open source alternative to Doppler. Self-hostable, with end-to-end encryption and role-based access controls. Supports direct integration with deployment platforms and CI/CD pipelines.
HashiCorp Vault
For larger organizations, Vault provides dynamic secrets, lease-based access, and audit logging. Instead of sharing a static database password, Vault generates unique, short-lived credentials for each developer. When the lease expires, the credentials are automatically revoked.
Setting Up a Sharing Policy
Technical tools only work if the team follows a consistent policy. Here is a practical policy template:
Rule 1: No secrets in messaging platforms
API keys, tokens, passwords, and certificates must never be shared through Slack, Teams, Discord, email, or any messaging platform. No exceptions. If someone needs a secret, direct them to the team vault or use an ephemeral sharing link.
Rule 2: Use the principle of least privilege
Team members should only have access to the keys they need for their current work. A frontend developer does not need the production database password. A contractor working on a specific feature does not need access to the entire secret vault.
Rule 3: Rotate keys when team members leave
When someone leaves the team (whether they are fired, quit, or a contract ends), rotate every key they had access to within 24 hours. This is non-negotiable. You cannot know what they copied, where they stored it, or what machines still have cached credentials.
Rule 4: Audit access quarterly
Every quarter, review who has access to what. Remove stale permissions. Check if any keys are shared more broadly than necessary. Verify that the access list matches the current team roster.
Rule 5: Document key ownership
Every key should have a designated owner who is responsible for rotation, access control, and incident response. Without clear ownership, keys become orphaned and unmanaged when the person who created them moves to a different project.
Onboarding New Team Members Securely
New team member onboarding is the highest-risk moment for key sharing. Here is a secure onboarding workflow:
- Provision vault access. Add the new team member to the appropriate vaults with the minimum necessary permissions.
- Issue personal API keys where possible. Many services (AWS IAM, GitHub, GitLab) support per-user keys. Generate a personal key for the new team member instead of sharing a shared key.
- Set up local encryption. Ensure the new team member has their development environment configured with encrypted secret storage. Walk them through the team's
.envencryption workflow. - Verify access works. Confirm they can access what they need from the vault without requesting keys through insecure channels.
- Conduct a security brief. Five minutes explaining the team's key sharing policy prevents months of insecure behavior. Cover the rules, show the tools, and make it clear where to ask questions.
Handling Contractor and Temporary Access
Contractors and temporary collaborators need special handling because their access must be time-bounded and revocable:
- Create scoped keys. Generate API keys with the minimum permissions the contractor needs. If the service supports it, set an expiration date on the key itself.
- Use separate vaults. Create a contractor-specific vault or project in your secret manager. When the contract ends, revoke the entire vault.
- Use ephemeral sharing for one-time needs. If a contractor needs a key for a single task, use a one-time-view link rather than adding them to a permanent vault.
- Calendar rotation reminders. Set a calendar reminder for the contract end date to rotate all keys the contractor accessed.
When Keys Get Shared Insecurely
If a key has already been shared through an insecure channel, treat it as compromised:
- Rotate the key immediately. Generate a new key and update all systems that use it.
- Delete the insecure message. Remove the Slack message, delete the email, clear the document. This does not guarantee the key is gone (backups exist), but it reduces future exposure.
- Check usage logs. Review the API provider's access logs for unauthorized usage between the time of sharing and the time of rotation.
- Educate, do not punish. The team member who shared the key insecurely did so because the secure path was unclear or inconvenient. Fix the process, not the person.
The measure of a team's security culture is not whether keys are ever shared insecurely. It is how fast the team responds when it happens and how quickly the process is improved to prevent recurrence.
Quick Reference
- One-time sharing: 1Password Send, Doppler Share, PrivateBin, age encryption
- Ongoing team access: 1Password Teams, Doppler, Infisical, HashiCorp Vault
- Never use: Slack, email, Google Docs, Notion, shared spreadsheets, sticky notes
- Always rotate: when team members leave, when contractors finish, when keys are shared insecurely
- Always audit: quarterly access reviews, key ownership verification, permission scope checks
Sharing API keys securely is not about perfect tools. It is about building a workflow where the secure path is the easy path. When it is faster to use the team vault than to paste a key in Slack, your team will use the vault every time. Invest in making security convenient, and the compliance follows naturally.