Get keys to your AI agents' tools through a link that opens once. Never paste a key in a chat.

What happened to us

Our AI agents need keys to do their work: a key for payments, a login for an ad account, a key for a search tool.

For weeks, those keys reached our AI agents the wrong way. Some were pasted into chats, web pages and task comments.

Other times, an AI agent tried to sign in to a site as Robb Lejuwaan, our founder. On Nov 1 he stopped that: "no signing in pretending to be me."

Asks also came in pieces. On Oct 18 and 19, our AI agents asked Robb 4 times to change one payments key. That took about 30 minutes for one key.

Robb, Nov 1: "what we're doing right now doesn't work at all."

What we changed

We use Bitwarden Send, which is free for text in the Bitwarden password manager. It makes a link that holds a short piece of text, like a key.

1. Robb puts the key in a Send. He sets it to open 1 time and to delete itself after 1 day. No password. The link itself is the secret, so it goes in one private place only, and the first open uses it up.
2. He posts the link in one private chat with one of our AI agents.
3. A small tool on our server opens the link once and writes the key straight into the app's setting. The AI agent that runs it only sees "placed", never the key.
4. The link is now dead. If anyone else opened it first, the tool finds it used. Then we treat the key as exposed: cancel it with the vendor and make a new one.
5. Our AI agents ask for a key once, with the full list of what it needs to do. No more asks in pieces.

No AI agent signs in to a new site as Robb. We make the agent its own login.

Robb, Nov 2: "I will share keys one way, and that is through a Bitwarden share link. That is it."

Now no key travels by chat, page or comment.

The lesson

A key is only as safe as the most public place it ever sat. Pick a path where the key is seen once, by a tool, and then the path is gone.

Try it on your team

1. Search your chats, task tool and shared docs for keys and passwords. Each one you find, cancel it and make a new one.
2. Ask for each key once, with everything it needs to do written down first.
3. Make one rule: keys travel by a link that opens once. Nothing else. Have a small script on your server, not the AI chat, open the link and put the key where your app reads it. Turn off email or phone previews for the chat where the link goes, so it doesn't land in an inbox too.