Share API keys with a team — without pasting them anywhere

Why copying keys is the default mistake

The fastest way to share a key is also the worst: paste it in chat, where it lives in the logs, the backups and the screenshots of everyone in the room. From that moment the key belongs to the team chat, not to you.

The vault way

1. Add the key once to the encrypted key vault.
2. Grant access per member — each person gets their own device token.
3. The agent calls the model through the platform; the key itself never reaches team machines.
4. When someone leaves, revoke their access — the key stays put and keeps working for everyone else.

Rules that make sharing safe

• One key per provider, in the vault — never one key per person in their own .env.
• Names on access: whoever holds a token should be identifiable in the audit history.
• Set shared budgets before shared keys: token budgets stop one member’s experiment from spending the team’s month.
• Rotate on a calendar: key rotation is routine, not an emergency.

When someone leaves

1. Revoke their device access immediately.
2. Check recent audit entries under their identity for anything odd.
3. If the key ever touched their machine directly, rotate it anyway — it is one click in the vault.

Compare with the alternatives

A shared .env on a shared drive gives everyone the key and no revocation. The vault is the design covered in vault vs. .env: tokens you can revoke instead of secrets you must rotate.