HOW-TO
API key best practices: how to stop pasting keys into AI chat
API key best practices start with one rule: do not paste keys into ChatGPT, Claude or agent configs. Doing so puts credentials into the model’s context and into logs you cannot fully control. This guide shows how to store secrets in a vault, refer to them by name and substitute them when they are used.
THE PROBLEM
Why paste fails
- The model sees it
Once a key is in a prompt, the model, and often the provider, has seen it.
- Copies spread
Keys end up in Slack, notes and agent configs that nobody rotates.
- No clear record
When a key lives in a chat, you cannot prove who used it.
HOW TO
Stop pasting API keys. Vault, reference, substitute.
- Add the secret
Store the key in Joyst’s encrypted vault. It is private by default.
- Set permissions
Decide who can view, use or manage the secret.
- Reference by name
Point agents and tools at the secret’s name, never the raw value.
- Controlled substitution
When the secret is used, Joyst can substitute the value on the server. This is designed to keep the key out of the model’s context.
- Audit
Review who changed what as part of your governance.
WHAT JOYST DOES
An AI secrets vault, not an infrastructure secrets manager.
- Encrypted at rest
Vault entries are encrypted and private by default. You can choose to share them across the organisation.
- Use without pasting
Agents and packages refer to secrets by name, so people no longer paste keys into chat.
- Alongside your infrastructure tools
AWS Secrets Manager and HashiCorp Vault still hold infrastructure secrets. Joyst holds the credentials your agents need.
- Built into agents
Packages list the names of the secrets they need, never the keys themselves.
RELATED
Keep exploring.
- Resources hub
Practical guides to setting up and using Joyst.
Open - Secrets vault
Keys kept out of model context.
Open - Add and use secrets
Store keys in the vault and refer to them safely.
Open - Controlled substitution
Use vault secrets by name. Designed to keep keys out of the model’s context.
Open - Agents
Package skills, prompts, MCP servers and secrets into reusable setups.
Open - Stop pasting API keys: why it fails
Why pasting keys into AI chat fails audits.
Open - Create an agent package
Assemble skills, MCP servers, prompts and secrets into one setup.
Open
API keys in chat FAQ
That is what controlled substitution is designed to do. It inserts the value when it is used, without putting the raw key in the prompt the model sees.
No. Use your existing tools for infrastructure secrets, and use Joyst for the credentials your AI agents need.
Rotate them, store the new values in the vault and refer to them by name from then on.
Store keys in the vault. Stop pasting them into chat.
Create an organisation account and bring skills, prompts, MCP servers, secrets and agents into one private catalogue.
- Private to your organisation
- Draft, then publish
- Limited open beta