How to Send API Keys to Clients Safely
Delivering keys and tokens to a client in a way that looks professional and leaves nothing behind.
When you finish an integration or provision a new account, the last step is often handing the client an API key or access token. It is easy to treat this as an afterthought and paste the key into the delivery email. But an API key is a live credential. Anyone who reads that email, now or in the future, can call the API as your client, run up usage, and reach whatever data the key is scoped to. A polished delivery should protect that credential as carefully as the work that produced it.
Why keys do not belong in the delivery email
Email is a permanent, forwardable record. A key sent in the body sits in your sent folder, the client's inbox, and every backup of both, often for years. If either mailbox is compromised later, the key is right there waiting. Ticketing systems and shared docs have the same problem: the credential outlives its usefulness and keeps accumulating copies.
A one-time link separates the delivery from the record. You can still send a friendly, well-labeled email, but the key itself lives inside an encrypted link that works once and then deletes itself. The email that remains contains only a dead link.
A clean client delivery flow
- Generate the key in your own dashboard, scoped to only what the client needs.
- Paste it into Burn the Secret and set an expiry that gives the client a comfortable window to retrieve it.
- Add a passphrase for production keys and share it over a separate channel.
- Include the one-time link in your delivery email with a clear label such as "Your production API key (one-time link)."
- Confirm the client retrieved it, and note in your records that it was delivered securely.
Automate it at scale
If you onboard clients regularly, you can generate one-time links programmatically with the Burn the Secret API and drop the resulting link straight into your provisioning emails or portal. Every key gets the same encrypted, self-destructing treatment without a manual step. The tool is free, needs no signup to create a link, and encrypts everything in the browser so the server never sees the key.
Delivering keys to a client soon? Create a secure link on Burn the Secret.