API Keys
Production tokens pasted into Slack, committed .env files, and leftover README gists outlive the engineer who created them. One leaked key is a live login to billing, CRM, or cloud APIs.
Hypervault keeps API keys, secrets, and scopes in an encrypted EU vault, tagged by environment, with expiry and role-based access so only the owning team can read production tokens.
Why store API Keys in a digital vault
Staging keys get used in production
Without an environment field, a 'test' token ends up in a live integration. Labelling production vs staging on the vault item prevents that mix-up.
Scopes are wider than the ticket needed
Tokens copied from a vendor console keep admin rights nobody reviews. Recording permissions next to the key makes over-privilege visible.
Expiry is a dismissed calendar ping
When the reminder is ignored, the integration fails overnight. An expiration date on the item is something on-call can actually check.
Leavers still hold personal tokens
Keys created on a personal account never get rotated after offboarding. Owner and last-rotated fields make that gap obvious.
Who uses this template
Platform engineers
Separate production and staging keys, with owner and last-rotated dates on each service.
SRE and on-call
Open a vault item instead of asking the last person who 'had the Stripe key' in chat.
Agencies on client stacks
Hold client API credentials without storing them in the agency Git history.
Fields in this template
Keep every record complete and easy to find. Existing fields stay as they are; extras are added only when a vault item would otherwise be incomplete.
- Service name
- API key/Token
- Secret key
- Environment (Production/Staging/Development)
- Expiration date
- Permissions/Scopes
- Owner/Team
- Last rotated
- Notes
How it works in Hypervault
Create from the template
Add an item from the API Keys template in your workspace.
Fill and attach
Complete the fields and attach supporting files where needed.
Share with the right roles
Give access only to the people who maintain or use this record.
Store it in a vault, not a spreadsheet
Create a workspace, pick this template, and keep credentials and supporting files encrypted in the EU.