Design API Key and Secret Interfaces

Collaboration & Enterprise · enterprise, security, developer

Updated 2026-07-28

Show a secret exactly once, and say so before it is created. Users need to know they must copy it now, not discover it after closing the dialog.
Make copying effortless and confirm it worked. This is the one place where a failed clipboard action costs a full round of key rotation.
Label every key with a purpose and an owner. A list of anonymous keys is a list nobody dares delete, so old credentials live forever.
Show last used and created dates. They are the only practical way to identify a key that can safely be removed.
Scope keys narrowly by default. A creation flow that offers full access as the easy option produces a product full of over-privileged credentials.
Support rotation without downtime by allowing two active keys during a changeover, and say plainly how to switch.
Make revocation immediate and clearly irreversible, and say what will break when it happens.
Never display secrets in full in logs, exports, screenshots, or support tools, and mask them consistently everywhere they appear.
Warn on expiry well in advance, to the person who owns the key rather than to whoever created the account.

A credentials screen is a security control with a user interface, and most leaks start with a key nobody remembered creating.