How to Share API Keys and .env Files with Developers (Safely)

Why API keys leak so often

Secrets travel through chats, tickets, emails, and repos—and then live forever in backups. Even private repos get cloned and laptops get lost. Treat delivery and storage separately: deliver ephemerally, store properly.

Golden rules for secrets

• Never commit secrets (keys, tokens, .env files) to any repo.
• Use .gitignore for .env, and keep prod and staging secrets separate.
• Least privilege: scope tokens tightly; avoid all-powerful keys.
• Rotate keys on role changes, incidents, and handoffs.

Safe delivery pattern (works everywhere)

• One-time link with short expiry (24–72h) and an access code.
• Split channels: send link in chat/email; send the access code by call or SMS.
• Zero-knowledge: prefer client-side encryption so providers can’t read content. Primer: The Beginner’s Guide to Zero-Knowledge Sharing.
• Verify identity before revealing prod secrets. Link hygiene: Verify Links Like a Pro.

Step-by-step for .env delivery

• Step 1 — Prepare: put only the required keys in the file; note scopes and expiry.
• Step 2 — Deliver: send via single-view, expiring link + separate access code. How-to: The Safe Way to Share Passwords in 2025 (No Email).
• Step 3 — Store: recipients save secrets into their local .env and a password manager (as secure notes).
• Step 4 — Clean up: after first use, rotate high-impact keys and remove the delivery link.

Developer checklist

• [ ] No secrets in repo history or code comments
• [ ] .env in .gitignore; prod vs. staging split
• [ ] One-time delivery with short expiry + split channels
• [ ] Save in manager; audit who has what
• [ ] Rotate keys at handoff/hire/departure

Common mistakes (and fixes)

• Base64 ≠ encryption: don’t rely on encoding as “security.”
• Screenshots of keys in chats: avoid; use one-time delivery instead.
• Over-scoped tokens: generate per-service, least privilege.

Related reading

Delivery basics: The Safe Way to Share Passwords in 2025 (No Email)

Compare methods: One-Time Links vs. Encrypted Email

Zero-knowledge primer: The Beginner’s Guide to Zero-Knowledge Sharing

Incident response: Leaked Passwords Playbook

Link hygiene: Verify Links Like a Pro

Bottom line

Secrets should be easy to use and hard to leak. Deliver with one-time links, store in a manager, and rotate often—especially for production.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.