[{"data":1,"prerenderedAt":385},["ShallowReactive",2],{"globals":3,"cookie-settings":230,"page-guides/share-an-api-key":263},{"id":4,"title":5,"description":6,"logo_light":7,"logo_dark":7,"address":7,"contact_email":8,"contact_phone":7,"header_menu":9,"footer_menu":10,"favicon":7,"public_url":11,"meta_title":12,"meta_description":13,"robots":14,"head_scripts":15,"body_scripts":16,"default_header":17,"default_footer":196,"social_links":7},1,"CredenShare","Secure credential sharing for modern teams. Encrypted in your browser, with time-limited, access-controlled links.",null,"hello@credenshare.io","fafb0437-6fc7-409e-bcce-a2519eacef43","96f782ae-6d59-4601-abd1-a4fca64cc4de","https://credenshare.io","CredenShare - Secure Credential Sharing","Share passwords, API keys and secrets securely with CredenShare. Encrypted in your browser, time-limited access, and detailed access logs.","# CredenShare Robots.txt\nUser-agent: *\nAllow: /\n\n# Sitemap\nSitemap: https://credenshare.io/sitemap.xml\n\n# Disallow admin paths\nDisallow: /api/\nDisallow: /admin/\nDisallow: /dev/\n\n# Allow main content\nAllow: /blog/\nAllow: /features/\nAllow: /pricing/\nAllow: /security/\nAllow: /docs/\n\n# Crawl-delay\nCrawl-delay: 1\n",[],[],{"id":18,"sort":7,"user_created":19,"date_created":20,"user_updated":19,"date_updated":21,"name":22,"logo":7,"show_cta":23,"cta_label":24,"cta_link":25,"cta_style":26,"sticky":23,"transparent":27,"navigation":28},"d16d4c9e-b3f8-4ea8-988b-eab863efb29c","e7d5f744-1dbd-47ad-9e01-63a9303d109e","2026-02-03T16:36:10.957Z","2026-08-17T22:46:13.371Z","Default Header",true,"Get Started","https://app.credenshare.io/register","primary",false,{"id":9,"sort":7,"user_created":19,"date_created":29,"user_updated":7,"date_updated":7,"title":30,"location":31,"items":32},"2026-02-03T16:36:40.078Z","Main Navigation","main-menu",[33,44,52,56,64,72,80,87,90,97,106,113,118,125,133,138,145,153,161,169,172,180,188],{"id":34,"sort":35,"user_created":19,"date_created":36,"user_updated":19,"date_updated":37,"label":38,"type":39,"url":40,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":42,"description":43,"badge":7},"157a8094-f17f-4348-bd73-774c0573b088",0,"2026-10-04T15:58:24.950Z","2026-10-23T23:13:13.022Z","Guides & Templates","custom","/resources","bf76488c-e318-48a2-8561-c32f76c61383","i-heroicons-document-text","Free practical guides and checklists",{"id":45,"sort":4,"user_created":19,"date_created":46,"user_updated":7,"date_updated":7,"label":47,"type":39,"url":48,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":50,"description":51,"badge":7},"1ee916dd-34a1-41fc-ad80-64681d2440ed","2026-02-11T11:19:14.086Z","Features","/features","0a887c3c-a748-4217-9e34-daf852801d4e","i-heroicons-sparkles","Everything CredenShare offers",{"id":49,"sort":4,"user_created":19,"date_created":53,"user_updated":7,"date_updated":7,"label":54,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:13.606Z","Product","dropdown",{"id":57,"sort":4,"user_created":19,"date_created":58,"user_updated":7,"date_updated":7,"label":59,"type":39,"url":60,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":62,"description":63,"badge":7},"fd3cae1e-592b-413d-91e5-b1258e0aff49","2026-02-11T11:19:16.508Z","Team Onboarding","/solutions/team-onboarding","daee37a1-a164-4b63-be67-1f91e4e9b497","i-heroicons-user-plus","Securely onboard new team members",{"id":65,"sort":4,"user_created":19,"date_created":66,"user_updated":7,"date_updated":7,"label":67,"type":39,"url":68,"parent":41,"post":7,"navigation":9,"target":69,"classes":7,"page":7,"icon":70,"description":71,"badge":7},"0bacbbcf-acfb-4054-94dd-b3388ed7f576","2026-10-23T23:13:21.028Z","Compare","/compare","_self","i-heroicons-scale","Password managers and sharing tools compared",{"id":73,"sort":74,"user_created":19,"date_created":75,"user_updated":7,"date_updated":7,"label":76,"type":39,"url":77,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":78,"description":79,"badge":7},"63e46db0-4bed-4f24-b7bd-a79e821f3d89",2,"2026-02-11T11:19:16.976Z","Third-Party Access","/solutions/third-party-access","i-heroicons-users","Safe contractor credentials",{"id":81,"sort":74,"user_created":19,"date_created":82,"user_updated":7,"date_updated":7,"label":83,"type":39,"url":84,"parent":41,"post":7,"navigation":9,"target":69,"classes":7,"page":7,"icon":85,"description":86,"badge":7},"704e9cab-d404-4b7a-b5c1-d8d66aa45862","2026-10-23T23:13:21.131Z","How-to Guides","/guides","i-heroicons-light-bulb","Share passwords and secrets safely",{"id":61,"sort":74,"user_created":19,"date_created":88,"user_updated":7,"date_updated":7,"label":89,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:16.058Z","Solutions",{"id":91,"sort":74,"user_created":19,"date_created":92,"user_updated":7,"date_updated":7,"label":93,"type":39,"url":94,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":95,"description":96,"badge":7},"6eb63ded-6ac9-4595-a55f-8795b193fe04","2026-02-11T11:19:14.648Z","How It Works","/how-it-works","i-heroicons-play-circle","See CredenShare in action",{"id":98,"sort":99,"user_created":19,"date_created":100,"user_updated":19,"date_updated":101,"label":102,"type":39,"url":103,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":104,"description":105,"badge":7},"8a9a4df2-3f19-4897-948a-a4d520b9389b",3,"2026-02-11T11:19:20.202Z","2026-10-23T23:13:13.401Z","Documentation","https://docs.credenshare.io","i-heroicons-book-open","Guides and API reference",{"id":107,"sort":99,"user_created":19,"date_created":108,"user_updated":7,"date_updated":7,"label":109,"type":39,"url":110,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":111,"description":112,"badge":7},"1cf2f869-1bb4-447a-b9d7-738b45995379","2026-02-11T11:19:17.466Z","Credential Collection","/solutions/secure-requests","i-heroicons-inbox-arrow-down","Request credentials securely",{"id":114,"sort":99,"user_created":19,"date_created":115,"user_updated":7,"date_updated":7,"label":116,"type":39,"url":117,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"790829b5-6e85-45a2-b729-01a224f1c816","2026-02-11T11:19:18.867Z","Pricing","/pricing",{"id":119,"sort":99,"user_created":19,"date_created":120,"user_updated":7,"date_updated":7,"label":121,"type":39,"url":122,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":123,"description":124,"badge":7},"5c9151ac-94e1-4d54-8032-768568b9ad02","2026-02-11T11:19:15.116Z","Security","/security","i-heroicons-shield-check","Our security architecture",{"id":126,"sort":127,"user_created":19,"date_created":128,"user_updated":7,"date_updated":7,"label":129,"type":39,"url":130,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":131,"description":132,"badge":7},"d7882f47-9f94-4860-93df-0025ff5ac8bc",4,"2026-02-11T11:19:15.577Z","Integrations","/integrations","i-heroicons-puzzle-piece","Slack, API, and more",{"id":134,"sort":127,"user_created":19,"date_created":135,"user_updated":7,"date_updated":7,"label":136,"type":39,"url":137,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"e696e64d-65e1-4b67-aef9-60db78b9f4cf","2026-02-11T11:19:19.313Z","Blog","/blog",{"id":139,"sort":127,"user_created":19,"date_created":140,"user_updated":7,"date_updated":7,"label":141,"type":39,"url":142,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":143,"description":144,"badge":7},"2ac2df39-fbae-45a2-b87a-313bebb4a87b","2026-02-11T11:19:17.957Z","Development Teams","/solutions/development-teams","i-heroicons-code-bracket-square","Secure credentials for dev workflows",{"id":146,"sort":127,"user_created":19,"date_created":147,"user_updated":19,"date_updated":148,"label":149,"type":39,"url":150,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":151,"description":152,"badge":7},"719ce073-d71f-4450-b45a-f08a05db21b2","2026-02-11T11:19:20.640Z","2026-10-23T23:13:13.301Z","About","/about","i-heroicons-information-circle","Our mission and team",{"id":154,"sort":155,"user_created":19,"date_created":156,"user_updated":7,"date_updated":7,"label":157,"type":39,"url":158,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":159,"description":160,"badge":7},"e18246ff-9a00-449a-88f8-09490a3cead2",5,"2026-08-24T23:17:28.605Z","Vendor Access","/solutions/vendor-access","i-heroicons-building-office-2","Share credentials with outside vendors",{"id":162,"sort":155,"user_created":19,"date_created":163,"user_updated":19,"date_updated":164,"label":165,"type":39,"url":166,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":167,"description":168,"badge":7},"567bc13d-4499-4dc5-a346-5eba54c1c500","2026-02-11T11:19:21.085Z","2026-10-23T23:13:13.212Z","Tools","/tools","i-heroicons-wrench-screwdriver","Free security & developer tools",{"id":41,"sort":155,"user_created":19,"date_created":170,"user_updated":7,"date_updated":7,"label":171,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:19.768Z","Resources",{"id":173,"sort":174,"user_created":19,"date_created":175,"user_updated":7,"date_updated":7,"label":176,"type":39,"url":177,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":178,"description":179,"badge":7},"99bda669-3c3a-4521-815b-a1eb22a4098e",6,"2026-08-24T23:17:28.791Z","AI Agents","/solutions/ai-agents","i-heroicons-cpu-chip","Give agents scoped, expiring credentials",{"id":181,"sort":174,"user_created":19,"date_created":182,"user_updated":19,"date_updated":183,"label":184,"type":39,"url":185,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":186,"description":187,"badge":7},"1f787a64-8e12-484d-ae97-b6349bc82e52","2026-02-11T11:19:21.524Z","2026-10-23T23:13:13.121Z","Pastebin","https://paste.credenshare.io","i-heroicons-clipboard-document","Secure encrypted pastebin",{"id":189,"sort":190,"user_created":19,"date_created":191,"user_updated":19,"date_updated":192,"label":193,"type":39,"url":194,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":159,"description":195,"badge":7},"1f06247b-4633-4341-a388-95ffa524a27a",7,"2026-02-11T11:19:18.416Z","2026-08-24T23:17:03.952Z","Enterprise","/enterprise","Compliance and audit-ready security",{"id":197,"sort":7,"user_created":19,"date_created":198,"user_updated":19,"date_updated":199,"name":200,"logo":7,"tagline":201,"show_social":23,"copyright_text":202,"show_newsletter":23,"newsletter_heading":203,"newsletter_description":204,"navigation_columns":205,"bottom_links":206},"355d9ac1-c909-4cda-9071-cd3abb00a0b5","2026-02-03T16:36:11.825Z","2026-11-02T14:01:12.933Z","Default Footer","Secure credential sharing for modern teams.","© {year} CredenShare Inc. All Rights Reserved.","Stay updated","Credential incidents explained and practical guides, every two weeks. Unsubscribe any time.",[],{"id":207,"sort":7,"user_created":19,"date_created":208,"user_updated":7,"date_updated":7,"title":209,"location":210,"items":211},"861b9a44-206d-4778-9251-f5269206fdf9","2026-02-03T16:36:41.786Z","Legal Links","legal-menu",[212,218,224],{"id":213,"sort":4,"user_created":19,"date_created":214,"user_updated":19,"date_updated":215,"label":216,"type":39,"url":217,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"3e16a067-ce9f-4e4d-aea6-7a602094f9df","2026-02-03T16:37:32.902Z","2026-08-25T00:24:57.325Z","Terms of Service","/legal/terms",{"id":219,"sort":74,"user_created":19,"date_created":220,"user_updated":19,"date_updated":221,"label":222,"type":39,"url":223,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"6e9bc58b-b6d0-46f8-8c7b-123ea3273f5b","2026-02-03T16:37:32.360Z","2026-08-25T00:24:57.850Z","Privacy Policy","/legal/privacy",{"id":225,"sort":99,"user_created":19,"date_created":226,"user_updated":19,"date_updated":227,"label":228,"type":39,"url":229,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"78a410a6-802d-4920-a915-d8e5d2155f0c","2026-02-03T16:37:33.462Z","2026-08-25T00:24:59.086Z","Cookie Policy","/legal/cookies",{"enabled":23,"banner_position":231,"banner_title":232,"banner_text":233,"accept_all_text":234,"decline_all_text":235,"preferences_text":236,"save_preferences_text":237,"policy_page":238,"privacy_page":240,"categories":242,"id":4},"bottom","We value your privacy","We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. By clicking \"Accept All\", you consent to our use of cookies.","Accept All","Decline All","Manage Preferences","Save Preferences",{"slug":239},"legal/cookies",{"slug":241},"legal/privacy",[243,248,253,258],{"id":244,"name":245,"key":246,"description":247,"required":23,"default_enabled":23},"1","Essential","essential","Required for the website to function. Cannot be disabled.",{"id":249,"name":250,"key":251,"description":252,"required":27,"default_enabled":27},"2","Analytics","analytics","Help us understand how visitors interact with our website.",{"id":254,"name":255,"key":256,"description":257,"required":27,"default_enabled":27},"3","Marketing","marketing","Used to deliver relevant advertisements and track campaign performance.",{"id":259,"name":260,"key":261,"description":262,"required":27,"default_enabled":27},"4","Preferences","preferences","Remember your settings and preferences for a better experience.",{"id":264,"status":265,"sort":7,"user_created":19,"date_created":266,"user_updated":19,"date_updated":267,"title":268,"slug":269,"seo":270,"revision":7,"user_published":7,"date_published":278,"blocks":279,"featured_image":7,"header_override":7,"footer_override":7},"fbe2e297-5966-4fb3-97ae-45d7fb651618","published","2026-10-28T12:49:44.679Z","2026-11-02T14:01:11.860Z","How to share an API key securely, and when to rotate it","guides/share-an-api-key",{"title":271,"meta_description":272,"no_index":27,"no_follow":27,"og_title":273,"og_description":273,"og_image":7,"sitemap_change_frequency":274,"sitemap_priority":275,"additional_fields":276},"How to share an API key securely (and when to rotate it)","Scope the key, send it in a link that expires, rotate when the job ends. A step-by-step handoff, and what AWS, Google, Stripe and GitHub say on rotation.","","monthly",0.6,{"canonical_url":277},"https://credenshare.io/guides/share-an-api-key","2026-11-02T14:01:11.863Z",[280,299,306,319,362],{"id":281,"collection":282,"item":283},1164,"block_hero",{"id":284,"sort":7,"user_created":19,"date_created":285,"user_updated":7,"date_updated":7,"headline":268,"subheadline":286,"background_type":7,"background_color":7,"background_image":7,"background_video":7,"gradient_start":7,"gradient_end":7,"gradient_direction":7,"overlay_color":7,"overlay_opacity":7,"height":7,"content_width":7,"text_alignment":287,"vertical_alignment":7,"text_color":7,"buttons":288,"style":7},"10d70dd9-e8d2-4ae6-86b3-9a0b29bb0b26","2026-10-28T12:49:44.706Z","API keys get shared constantly: with a new developer, a contractor, an agency, a vendor. Here is how to hand one over without leaving it in chat, and a practical answer to how often it should be rotated.","center",[289,294],{"id":290,"sort":4,"user_created":19,"date_created":291,"user_updated":7,"date_updated":7,"hero_id":284,"label":292,"url":293,"style":26,"size":7,"icon":7,"icon_position":7,"open_new_tab":7},"5d77ad81-ebd5-4157-97bf-89f5b40f9c6b","2026-10-28T12:49:44.718Z","Start free","https://app.credenshare.io/register?utm_source=credenshare.io&utm_medium=guide&utm_campaign=share-an-api-key",{"id":295,"sort":74,"user_created":19,"date_created":296,"user_updated":7,"date_updated":7,"hero_id":284,"label":297,"url":84,"style":298,"size":7,"icon":7,"icon_position":7,"open_new_tab":7},"243f8d6d-8b04-44d6-b58e-22e975df0c0e","2026-10-28T12:49:44.745Z","All guides","outline",{"id":300,"collection":301,"item":302},1165,"block_markdown",{"id":303,"sort":7,"user_created":19,"date_created":304,"user_updated":7,"date_updated":7,"content":305},"14cb0108-0ef6-438f-a14f-24db4a245afc","2026-10-28T12:49:44.780Z","## The short answer\n\nTo share an API key securely:\n\n1. **Share less.** Give the person their own key where the provider allows it, restricted to what they need, ideally with an expiry date. Use a test or sandbox key if that's all the job needs.\n2. **Send it as an encrypted link that expires**, never as a chat message or email, with a passcode through a second channel.\n3. **Rotate or revoke it when the job ends**, and whenever someone who had it leaves.\n\nOn rotation, vendors no longer agree on a fixed calendar. Rotate **on events** every time (someone leaves, a key was exposed, a vendor finishes), prefer keys that **expire on their own**, and set a schedule only for long-lived keys you can't avoid.\n\n**Who this is for:** developers and team leads who hand API keys to teammates, contractors and vendors, and the IT or platform people who issue them.\n\n## Why do API keys leak when you share them?\n\nAn API key is a password that never asks for a second factor. Whoever holds it is, as far as the API is concerned, you. Keys tend to leak at the moment they are shared:\n\n- **Chat and email keep them.** A key pasted into Slack, Teams or email stays in message history, search and backups for years.\n- **They get copied into code.** The recipient pastes the key into a script or config file \"just to test\", and it ends up in a repository. Google's own guidance warns that keys hardcoded in source code or stored in a repository are open to theft.\n- **One key, many people.** When a whole team, a contractor and a CI job share one key, nobody can tell who used it, and revoking it breaks everyone.\n- **They outlive the job.** The contractor finishes, the key keeps working.\n\n## What should you do before you share an API key?\n\nThe safest key to share is one that can do little, for a short time, for one person.\n\n| Step | Why | Examples |\n|---|---|---|\n| **One key per person or vendor** | You can revoke one without breaking the others, and logs show who did what | A separate restricted key for the agency; your own key stays yours |\n| **Restrict it** | A leaked key can only do what it's allowed to | Stripe restricted keys (`rk_`); Google Cloud API key restrictions; GitHub fine-grained tokens scoped to one repository |\n| **Give it an expiry** | It stops working even if nobody remembers to revoke it | GitHub token expiration; Stripe scheduled rotation or expiry |\n| **Use test keys for test work** | A leaked sandbox key can't touch production | Stripe `sk_test_` / `rk_test_` keys |\n| **Prefer no key at all** | Temporary credentials beat any key you have to hand over | AWS IAM roles and federation; OIDC from CI |\n\nAWS puts the last point plainly: where possible, rely on temporary credentials rather than long-term access keys.\n\n## How do you share an API key securely, step by step?\n\n1. **Create a share.** In CredenShare, open **Shares** and click **Create Share**. Put the key in a **Password** field, so it is masked until the recipient reveals it, and use a second field for context such as the environment or the allowed scopes.\n2. **Keep the title generic**, for example \"Payments API key, staging\". Titles and descriptions are stored readable, so the list can show and search them. Only the fields are encrypted in your browser.\n3. **Set the rules:** a short expiry, a view limit of one, and a **passcode** (Solo and above). If you don't know when they'll open it, set **Expire from** to **First View**.\n4. **Send the link and the passcode through different channels**, for example the link by email and the passcode by text message.\n5. **Confirm it arrived.** On paid plans the access log shows when the link was opened and from where, with link scanners labelled. Activity emails, on every plan, can tell you when it's opened.\n6. **Ask them to store it properly**, in their secrets manager or password manager, not in a config file in a repository.\n\n**No account?** [SecurePaste](https://paste.credenshare.io) is free with no sign-up. Paste the key, keep **Burn after reading** on, and add a password. The link expires after 24 hours.\n\n**Need a key *from* someone?** When a client or vendor has to send you their API key, send them a [Secure Request](/solutions/secure-requests) (Business and Enterprise): a form whose answers are encrypted in their browser, instead of asking them to email it.\n\n## How do you share an API key with a contractor or vendor?\n\n**Scenario:** an agency needs to call your payments API from a staging site for three weeks.\n\n1. Create a **restricted key just for them**, limited to the endpoints the integration uses, in the test environment if they don't need live data.\n2. Put the key in a share with a passcode, an expiry of a few days counted from the first view, and one view.\n3. Send the link to your contact by email and the passcode by text message, and check that it was opened.\n4. Note in your access register who holds which key and until when.\n5. When the project ends, **expire or rotate that key**. Because it was theirs alone, nothing else breaks. The [contractor and vendor access close-out](/resources/contractor-access-closeout) covers the rest of the offboarding.\n\n## How often should API keys be rotated?\n\nThere is no single number, and the major vendors have moved away from fixed calendars:\n\n| Provider | What its documentation recommends |\n|---|---|\n| **AWS (IAM access keys)** | Prefer temporary credentials. For long-term access keys, update them **when needed**, for example when an employee leaves, and use \"last used\" information to remove keys safely. |\n| **Google Cloud (API keys)** | **Rotate periodically**: create a new key, update your applications, delete the old one. Delete keys you no longer use. |\n| **Stripe** | **Rotate when team members with access leave.** Rotation can be scheduled, and keys can be expired. |\n| **GitHub (personal access tokens)** | **Add an expiration** to tokens. Unused tokens are removed automatically after a year. Prefer fine-grained tokens. |\n\n*Checked on October 28, 2026 against each vendor's documentation (sources below).*\n\nWhat this adds up to in practice:\n\n| Kind of key | Recommended approach |\n|---|---|\n| Keys held by people (developers, contractors, agencies) | One per person; **expiry date** where supported; revoke when they leave or the project ends |\n| Keys used by your own servers or CI | Replace with **temporary credentials** (roles, OIDC) where the platform allows; otherwise rotate on a schedule you can automate, for example every 90 days |\n| Keys shared with a vendor or third party | Restricted, per-vendor key; review it at each contract renewal; revoke when the relationship ends |\n| Any key that may have been exposed | **Rotate immediately**, whatever the schedule says |\n\nThe 90 days is our suggestion for keys you can't avoid, not a vendor rule. Pick an interval you can actually automate: a schedule nobody follows is worse than event-based rotation done well.\n\n## When must you rotate an API key immediately?\n\n- Someone who had the key **leaves** the team or company.\n- A **contractor, agency or vendor** that had it finishes their work.\n- The key appeared somewhere it shouldn't: **chat, email, a ticket, a screenshot, a log, a repository**.\n- A device or account that held the key may be **compromised**, for example by an infostealer.\n- You can't say **who has it**.\n\n## How do you rotate an API key without downtime?\n\n1. **Create the new key** alongside the old one. Many providers let you keep two keys active at once, and Stripe can rotate a key on a schedule.\n2. **Deploy it** to every place that uses the old key: secrets manager, CI, servers, the people who need it (by an expiring link).\n3. **Verify** that traffic is using the new key. AWS's \"last used\" information, or your provider's request logs, show whether the old key is still being called.\n4. **Revoke the old key.** Expire or delete it, rather than leaving it \"just in case\".\n\n## What should you do if an API key leaked?\n\n1. **Rotate it first.** Deleting the message, the commit or the log doesn't help: copies may already exist.\n2. **Check the provider's logs** for use of the leaked key since the exposure.\n3. **Find out how it leaked**, and fix that path: a pasted message, a committed file, a CI log. Our [breakdown of the Gheist campaign](/blog/gheist-github-actions-secrets) shows how secrets in CI were read with nothing more than stolen push access.\n4. Work through the [credential exposure first-actions card](/resources/credential-exposure-response-card).\n\n## Summary\n\n- Share **less**: one restricted key per person or vendor, test keys for test work, expiry where supported.\n- Send it as an **encrypted link that expires**, with a **passcode through a second channel**.\n- Rotate **on events** every time, prefer keys that **expire on their own**, and automate a schedule for the long-lived ones you can't avoid.\n- When a key leaks, **rotate first**, then investigate.\n\n**Related:** [How to share .env files with your team securely](/guides/share-env-files) · [The secret zero problem](/blog/secret-zero-problem) · [API Key Generator](/tools/api-key-generator) · [All guides](/guides)\n\n---\n\n**Sources** (checked on October 28, 2026):\n[AWS: Security best practices in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) ·\n[Google Cloud: Best practices for managing API keys](https://cloud.google.com/docs/authentication/api-keys-best-practices) ·\n[Stripe: API keys](https://docs.stripe.com/keys) ·\n[GitHub: Managing your personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) ·\n[OWASP: Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n\n*Product names are trademarks of their respective owners. CredenShare is not affiliated with them.*",{"id":307,"collection":308,"item":309},1166,"block_newsletter",{"id":310,"sort":7,"user_created":19,"date_created":311,"user_updated":7,"date_updated":7,"headline":312,"description":313,"placeholder_text":314,"button_text":315,"button_style":26,"form_action":7,"success_message":316,"error_message":317,"layout":318,"show_name_field":7,"background_color":7,"text_color":7,"style":7},"acbda565-7efd-4c8e-bd52-cc36f3f21c73","2026-10-28T12:49:44.812Z","Get the next guide in your inbox","Every two weeks: one credential incident explained, three things worth knowing, and the practical steps from our latest guides. Unsubscribe any time.","Your work email","Subscribe","Almost there: check your inbox for a confirmation link.","Something went wrong. Please try again.","card",{"id":320,"collection":321,"item":322},1167,"block_accordion",{"id":323,"sort":7,"user_created":19,"date_created":324,"user_updated":7,"date_updated":7,"headline":325,"allow_multiple":23,"default_open_index":7,"items":326,"style":7},"3f0a6f02-3a5c-46ed-ac74-30c33ac665a6","2026-10-28T12:49:44.832Z","Frequently asked questions",[327,332,337,342,347,352,357],{"id":328,"sort":4,"user_created":19,"date_created":329,"user_updated":7,"date_updated":7,"accordion_id":323,"title":330,"content":331},"eeaf19e6-c769-41b9-8641-67ad84f70c86","2026-10-28T12:49:44.850Z","What is the safest way to share an API key?","Give the person their own restricted key where possible, send it as an encrypted link that expires after one view, and send the passcode through a different channel. Never paste it into chat or email.",{"id":333,"sort":74,"user_created":19,"date_created":334,"user_updated":7,"date_updated":7,"accordion_id":323,"title":335,"content":336},"7e1c725e-2ab9-4e2e-8be4-2076eafbd1d4","2026-10-28T12:49:44.859Z","How often should API keys be rotated?","Rotate immediately when someone with access leaves, a vendor finishes, or the key may have been exposed. Prefer keys that expire on their own, and put any long-lived keys you can't avoid on a schedule you can automate.",{"id":338,"sort":99,"user_created":19,"date_created":339,"user_updated":7,"date_updated":7,"accordion_id":323,"title":340,"content":341},"245b4e64-4558-44bf-abf3-346d23eb9de6","2026-10-28T12:49:44.868Z","Is it safe to send an API key over Slack or email?","Not as plain text: messages stay in history, search and backups. Send an expiring, encrypted link instead, and rotate any key that was already pasted.",{"id":343,"sort":127,"user_created":19,"date_created":344,"user_updated":7,"date_updated":7,"accordion_id":323,"title":345,"content":346},"c0f465b9-b68d-4d96-83da-22f01baa6283","2026-10-28T12:49:44.877Z","Should each developer have their own API key?","Yes, wherever the provider allows it. Separate keys let you revoke one person's access without breaking everyone else, and show who used which key.",{"id":348,"sort":155,"user_created":19,"date_created":349,"user_updated":7,"date_updated":7,"accordion_id":323,"title":350,"content":351},"6f036611-273d-48f8-a772-5be1d49104e1","2026-10-28T12:49:44.885Z","How do I rotate an API key without downtime?","Create the new key alongside the old one, deploy it everywhere, confirm the old key is no longer being used, then revoke the old key.",{"id":353,"sort":174,"user_created":19,"date_created":354,"user_updated":7,"date_updated":7,"accordion_id":323,"title":355,"content":356},"d93775b0-35e3-4661-9152-16d068c73a20","2026-10-28T12:49:44.894Z","What should I do if an API key was committed to GitHub?","Rotate the key first, because the commit history, clones and forks keep it. Then check the provider's logs for misuse and remove the file from history if needed.",{"id":358,"sort":190,"user_created":19,"date_created":359,"user_updated":7,"date_updated":7,"accordion_id":323,"title":360,"content":361},"6c948f04-1283-4626-b26b-8fcdd89813f0","2026-10-28T12:49:44.904Z","How can a client send me their API key securely?","Send them a request form that encrypts their answer in their browser, such as a CredenShare Secure Request, instead of asking them to email it.",{"id":363,"collection":364,"item":365},1168,"block_cta",{"id":366,"sort":7,"user_created":19,"date_created":367,"user_updated":7,"date_updated":7,"headline":368,"description":369,"alignment":287,"layout":370,"background_type":371,"background_color":7,"background_image":7,"gradient_start":372,"gradient_end":373,"gradient_direction":374,"text_color":7,"buttons":375,"style":7},"e8116522-93c9-4742-a33c-acd068c560c1","2026-10-28T12:49:44.933Z","Hand over your next API key as a link that expires","Free plan: 3 shares a day, encrypted in your browser. Or use SecurePaste with no account.","stacked","gradient","#4c1d95","#7c3aed","to-right",[376,381],{"id":377,"sort":4,"user_created":19,"date_created":378,"user_updated":7,"date_updated":7,"cta_id":366,"label":379,"url":293,"variant":380,"size":7,"icon":7,"open_new_tab":7},"a0ddb6dc-703a-46d3-8050-4d5accae3637","2026-10-28T12:49:44.943Z","Get started free","solid",{"id":382,"sort":74,"user_created":19,"date_created":383,"user_updated":7,"date_updated":7,"cta_id":366,"label":384,"url":185,"variant":298,"size":7,"icon":7,"open_new_tab":7},"d099084c-e90b-4f17-bdd2-81cf2ee6cf09","2026-10-28T12:49:44.952Z","Try SecurePaste, no account",1794237316265]