Gareth MorgansSecurity
API key security: stop pasting keys into AI chat
It is a familiar shortcut, and a common gap in API key security. Someone pastes an API key into ChatGPT, Claude or Cursor so the agent can call the API. It works once. Then the key sits in chat history, model context, screenshots and exported threads.
That fails audits, and it leaves keys in places you cannot control.
Start free beta · Secrets vault
Why paste is risky
Chat products are not secrets managers. When you paste a key:
It enters the model context for that turn, and often for the whole conversation.
It can end up in provider logs, browser history and shared workspaces.
Anyone with access to the thread can copy it.
Rotating it means finding every place it was pasted, rather than updating one vault entry.
If chat is where your team keeps keys, you do not have a secrets policy. You have hope.
Model context exposure
Prompts, skills and agent setups should describe what to do. They should not contain credentials. Once a key is in the prompt or the chat, you cannot reliably show that it stayed out of logs, support exports or a colleague’s laptop.
The rule is simple: keep keys out of model context.
Controlled substitution instead
Two jobs need to be kept apart:
1. Store credentials in a private vault and share them deliberately.
2. Substitute them on the server when an approved agent or HTTP call needs them.
Joyst’s secrets vault is private by default. You share a secret with a group or the organisation when you choose to. Agents and controlled calls can use substituted values, which is designed to keep keys out of the chat the model sees.
It does not replace AWS Secrets Manager or HashiCorp Vault for infrastructure. It is for AI work: the keys used by the skills, agents and MCP workflows your team runs. See how secrets management built for AI agents compares with infrastructure tools.
What to do this week
1. Stop pasting new keys into chat.
2. Rotate any key already pasted into a shared thread.
3. Move working credentials into the Joyst vault.
4. Rewrite prompts and skills so they refer to secrets in the vault, not raw keys.
5. Tie access to groups, so finance keys stay with finance.
Pair this with AI governance when you need permissions and an audit trail showing who could see what.
Next steps: How-to: add and use secrets, How-to: controlled substitution and Agents (secrets in packages).
FAQ
Is this the same as a cloud secrets manager?
No. The two do different jobs. Infrastructure secrets managers protect production systems. Joyst’s vault is for AI work, such as prompts, skills, agents and MCP workflows, with private-by-default sharing and controlled substitution.
Can agents still call APIs?
Yes. For controlled calls, substitution happens on the server, so the model does not need the raw key in chat.
What if someone already pasted a key?
Rotate it and treat the paste as a leak. Then store the new value in the vault only.