Skip to content
temp.cool

How to share API keys with a contractor

1 min read · Updated

Short answer

Send each API key as its own temp.cool link that opens once and expires within a day, and create a separate key for the contractor so you can revoke it when the job is done.

  1. 1

    Create a key just for them

    Most services let you make extra API keys with limited rights. Give the contractor their own, never your main key.

  2. 2

    Put it in a one-time link

    Paste the key into temp.cool, set it to open once and to expire in 1 hour or 1 day.

  3. 3

    Send the link and check it was opened

    Send the link in your usual chat. Your manage link shows when it was opened.

Why it matters

API keys pasted into Slack, Teams, tickets or email stay searchable for years, by everyone in the channel and by anyone who later gets access. Leaked keys are one of the most common causes of cloud breaches and surprise bills.

Good habits

  • One key per person or company. Then you can revoke one without breaking everything else.
  • Least privilege. Give the key only the rights the job needs, and only for the services it touches.
  • Revoke when the work ends. Put a reminder in your calendar on the project’s end date.
  • Never commit keys to code. Ask the contractor to keep keys in environment variables or a secrets manager.

Sending many keys

Put several related values in one secret, one per line, for example a key, its ID and the endpoint. The link opens once, so the contractor should save them straight into their own secrets manager.

Got a secret to send?

Free, no account. Read once, then poof.

Write a secret