How to send an API key securely to another developer
The safest way to hand off an API key, token, or password one-time in 2026 is to use a burn-after-read tool that keeps the decryption key off the internet entirely. chirpfile encrypts the secret in your browser and transmits the decryption key to the other device as sound - the server never sees the key, and no chat history, email archive, or screen-share buffer retains it.
The everyday secret-sharing problem
You're in a pairing session and your colleague needs the staging database password. Or you're contracting for a client and they need the AWS access key. Or you're showing someone a quick demo and the OAuth client ID has to land on their laptop.
The usual options all have permanent-storage problems:
Slack DM. Persists in history forever, indexed in search, visible to anyone added to the channel later, sits on Slack's servers.
Email. Same problem plus inbox auto-backup to Gmail/Outlook/iCloud. Often archived to corporate mail retention.
Read it aloud. Slow, error-prone for any non-trivial key, painful with special characters. Recipient still has to type it.
Cloud doc / shared notes. Persists. Indexed. Often shared further or accidentally screen-grabbed.
SMS / iMessage. Backed up to iCloud or carrier, visible on every paired device, often previewed on lock screens.
What you actually want
One transfer. The secret arrives once on the recipient's device. No persistence anywhere.
No account setup. Both you and the recipient open a webpage. That's it.
No log trail. No chat history, no email archive, no cloud-doc revision.
Physical presence verification. Only someone in the same room as your device can receive. No remote interception.
Verifiable by someone paranoid. You can prove to yourself that the secret didn't touch anyone else's server.
How chirpfile does this
You type or paste the secret in your browser. If it's under 120 characters (which covers virtually every API key, OAuth token, database password, JWT), the secret is encoded directly into the chirp. No server touched. No upload. Pure sound between devices.
For longer secrets (multi-line credentials, JSON tokens, signed payloads), the secret is encrypted with AES-128-GCM in your browser, the ciphertext goes to a relay, and the decryption key travels via the chirp. The relay holds ciphertext it cannot decrypt. After download, the relay deletes its copy. After 15 minutes, anything unclaimed is deleted regardless.
Either way: the secret only exists on your device, on the recipient's device, and (briefly, encrypted) on the relay. Never in chat history, never in inbox backup, never in a cloud doc.
How it compares to other secret-sharing tools
PropertychirpfileBitwarden / Tresorit Send
Key channelSound (out-of-band)URL fragment
Risk if link is forwardedNone - no link contains the keyRecipient + anyone who got the URL
Physical presence requiredYes (recipient must be in audio range)No - remote works
Server can decryptNo (verifiable)No (asserted)
You can verify this yourself. Every chirpfile page runs a small audit script that wraps window.fetch and scans every outbound request body for the active AES key. If the key were ever transmitted, the audit panel at the bottom of the page would alarm. Read the script at /public/audit.js - about 230 lines of plain JavaScript. It's the exact code running in your browser right now.
Try it now
Open chirpfile.com on both devices. Type the secret. Listen for the chirp.
How do I send an API key securely to another developer?
Do not paste it into Slack, email, or a shared doc - those persist. For a one-time handoff to someone in the room, use chirpfile: the key is encrypted in your browser and transmitted to the other device as sound. For ongoing team-shared secrets, use a password manager (1Password, Bitwarden, Dashlane) with shared vaults. Never send API keys over unencrypted channels or channels that retain history.
Is it safe to send an API key over Slack?
No. Slack messages persist in channel history indefinitely, are indexed for search, are visible to anyone added later, and remain on Slack's servers. A single leaked Slack authentication token gives an attacker access to every key ever pasted into the workspace. The same problem exists for email, Teams, Discord, and iMessage. Any sent API key over these channels should be considered compromised and rotated.
How do I share credentials with a contractor without permanent access?
Use a burn-after-read tool that doesn't require the contractor to create an account. chirpfile is designed for this: the contractor opens the URL in a browser, hears the chirp from your device, and the credential appears once. Nothing persists in your chat history or their inbox. For longer-term contractor access, use your identity provider's guest-access feature or scoped API tokens with expiration.
When should I use chirpfile vs a password manager?
Password managers (1Password, Bitwarden, Dashlane) for ongoing team-shared secrets in a shared vault. chirpfile for one-time handoffs where the recipient is not on your password manager: a contractor needing temporary access, a colleague needing a key mid-meeting, a client at a demo, sharing with someone outside your organization.
Is sound really a secure channel - couldn't someone record it?
A recorder in the room can capture the chirp. The threat model is "no one else in the room is trying to attack you" - which matches the natural use case (you and a colleague in a meeting, you and a client at a table). If you're in a public space where someone might be recording, ultrasound mode reduces the audible signature but doesn't fully defeat a dedicated attacker with a wideband mic. For high-threat scenarios use proper key escrow.
Does the API key ever appear in any log?
No. The audit panel at the bottom of every chirpfile page verifies this in real time - it wraps window.fetch and scans every outbound body for the key. If the key were ever sent over the network, the alarm would fire. You can also inspect Chrome DevTools' Network tab directly and confirm the same.
What about multi-line secrets like a JSON config or a long token?
For text over 120 characters, the data is encrypted in your browser (AES-128-GCM) and uploaded as a blob. The encryption key still travels via sound - never over the network. Up to 15 MB free, 1 GB on Pro.
Can the recipient screenshot the secret?
Yes - chirpfile doesn't claim to defeat the recipient. If you don't trust the recipient with the secret, no transfer tool can help. The point is preventing the secret from being intercepted in transit and from persisting in chat history, inbox, or cloud storage where third parties have access.