Skip to lesson

Lesson 3 of 7 · HQ fundamentals

Store and Share API Keys with HQ Secrets

Save an API key with HQ’s secure form, choose who can use it, and share it without the key ever showing up in chat.

Begin lesson
Written path
8 steps

Before You Begin

  1. HQ is signed in to a company that’s set up for your team (see Lesson 2).

  2. You’re allowed to store the key and decide who uses it.

  3. You have the API key handy to paste.

Step-by-step walkthrough

  1. Step 1: Ask HQ for a safe place to put the key

    Tell HQ which API key your team needs. Don’t paste the key itself into the chat.

    PromptSend in your AI session
     I want to upload a [provider] API key for my team to use with HQ Secrets.
    Expected

    HQ gives you a secure link to paste the key into. The link works once and expires after 24 hours.

  2. Step 2: Paste the key into the secure form

    Open the link, paste the key, and click Submit. Don’t share the link in notes or chat.

    Go toOpen this place
     Open the link, paste the key, and submit
    Expected

    The key is saved without ever showing up in your chat with HQ.

  3. Step 3: Check that HQ got it

    Ask HQ to confirm the key arrived.

    PromptSend in your AI session
     Please validate you have received it.
    Expected

    HQ confirms it has the key and asks who should be able to use it: one person, a group, or the whole company.

  4. Step 4: Choose who can use it

    Share it with as few people as makes sense. This example makes a sales group. Use a name that fits your team.

    PromptSend in your AI session
     Create a new group called [group] and share it with [group].
    Expected

    HQ creates the group and gives it access to the key.

  5. Step 5: Check the key in HQ Console

    In HQ Desktop, click Open HQ Console and go to Secrets. You’ll see the key listed, but not its value.

    Go toOpen this place
     Click Open HQ Console in HQ Desktop, then open Secrets
    Expected

    The key is listed with who can use it, and the value stays hidden.

  6. Step 6: Know who can use a secret

    A company secret starts out private to whoever added it. You can share it with a person, a group, or the whole company, and choose whether they can read it, change it, or manage it. Personal secrets are yours alone and can’t be shared.

    Expected

    You know who’ll be able to use a key before you share it.

  7. Step 7: Share related knowledge with the same group

    If the group needs more than the key, like your sales playbook, share that with the same group too.

    PromptSend in your AI session
     Please share that API key with that group.
 Please share our [team] knowledge with that group.
    Expected

    The key and the knowledge are shared with one group, so there’s one place to manage who has access.

  8. Step 8: Check the final summary

    Read HQ’s summary. Make sure it names the right group and access, and doesn’t show the key.

    Expected

    The group is set up with access, and anyone added to it later can use the key without seeing it.

You’re done when

The key is stored, your group has access, and the key itself never showed up in chat.

Hit a snag? Here’s the fix.

The secure link expired

Links work once and expire after 24 hours. Ask HQ for a new one, it only takes a second.

A teammate can’t use the key

Check that they’re in the group you shared it with and signed in to HQ with the email that’s in your company. If they were added recently, have them run /hq-sync.

I pasted a key into the chat by mistake

Treat that key as exposed. Create a new one at the provider, turn off the old one, and store the new one through the secure form.

Something else going on? The HQ knowledge base walks through the most common fixes, or reach out and we’ll help you get unstuck.