# Who still has your client’s API keys? Find out before the handover. > Map the automations behind each client API key, agree who owns the access after the handover, then replace keys. Check people, AI tools and scripts separately. Page: https://cybee.ai/blog/client-api-key-handover/ (Client API key handover checklist) - [Blog](https://cybee.ai/blog/) - Client API keys your team The campaign is over, but a script still runs every morning with your client’s key. A practical handover for agencies whose scripts, automations or AI tools use client keys: what to keep, what to replace and what to remove. By [cybee](https://cybee.ai/about/#founders) Published 21.09.2026 Updated 24.09.2026 7 minute read In one minute - Client keys end up in scripts, in automation accounts, in AI connectors and in freelancers’ own tools. A handover is when you find them all. - Map every key first: the service, the job that depends on it and the person who owns it. Never copy the key itself into the record. - Agree with your client which access continues after the handover. - Replace or cancel keys at the service that issued them, then check that the old key no longer works. Deleting a local file does not cancel a key. - cybee shows which AI tools and connections are on your team’s Macs. The keys themselves are checked at each service. ## How should an agency hand over client API keys securely? List every client key your team uses, the jobs that depend on it and the person who owns it. Agree which access continues after the handover. Then replace or cancel the keys nobody needs at the service that issued them, update the workflows that should keep running and check the result. Deleting a local file does not cancel a key. **Q:** What is an API key? ### What an API key is. A long secret that lets a program use a service in someone’s name, such as a CRM, an email tool or a database. Whoever holds the key can use that access. It keeps working until the service that issued it cancels it, however many copies exist. **Q:** What does revoking a key mean? ### What revoking a key means. Cancelling it at the service that issued it, so it stops working everywhere at once. Rotating means you create a new key first, move the work to it, then cancel the old one. Deleting the key from a file, a laptop or a chat does neither. The key still works. ## Start with the automations that must keep working. The campaign is finished, but a lead routing script still runs every morning. The client’s CRM key also lives in a freelancer’s automation account. An assistant has a connector to the same system. A good handover starts with these working relationships, because changing a key before you understand them can interrupt your client’s business. Make one record for each service: the client’s owner, the purpose, the account or key name, the permissions, the place where it is stored and the workflow that depends on it. Include hosted automation platforms as well as laptops. Do not put the secret itself in the record, a ticket or a shared document. You need a map of access, not one more place that holds the keys. > You need a map of the keys. Not one more place that holds them. ## Put the client in control of the lasting setup. Your client should know who owns the account that runs an essential workflow. If it runs inside your agency’s own account, decide what happens to it: move it, rebuild it in the client’s account or keep managing it under a clear agreement. Check what the service allows before you promise a move between organisations without an interruption. Keep production work apart from experiments. A test connector from a pitch should not quietly become the permanent way into a client’s CRM. Where the provider allows it, use a separate key for each job and give each key only the access that job needs. A later change is then easier to follow, and it breaks less. 1 2 3 Figure: Map, replace, retire. In that order, so nothing your client relies on stops. ## Replace access without breaking the workflow. For a planned handover, agree a change window and an owner on each side. Follow the provider’s process to create the new access, update the workflows that should keep running and test one real job. Then cancel the old key and check that the old route no longer works. Some services rotate keys in a different order, so follow their documentation. If a key has been exposed, treat that as an incident. Do not wait for the next planned handover. GitHub’s guidance puts cancelling or rotating the key first when a secret was committed to a repository. Deleting the visible text does not remove the access it grants. Keep the useful details of the incident, without spreading the secret into more messages. Provider guidance: [Google Cloud: API key management](https://docs.cloud.google.com/docs/authentication/api-keys-best-practices) · [GitHub: removing sensitive data from a repository](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository) If a key was exposed Cancel or rotate it at the service first. Then clean up the file, the message or the repository. Deleting the text does not remove the access, so the order matters. ## Check the people, the agents and the jobs that run alone. Ask everyone who worked on the project which tools they connected. Look at editor integrations, AI assistants, deployment services and scheduled automations. Someone leaving a Slack channel does not mean their other access has ended. The same goes for cancelling an agency seat while a shared key still sits in an outside workflow. Finish with a short handover record: what stays active, who owns it, which keys were replaced, when the old access ended and what still needs a decision. Ask your client to confirm the workflows they rely on. Keep any exception visible, especially if support access continues after the final invoice. Figure: A short record your client can read: what stays, who owns it and the one exception, kept visible. ## Use the view of the Macs as one part of the check. cybee shows the AI tools installed on your team’s Macs and the connections set up in them. That gives the handover a useful place to start: which tools did this person connect? cybee also records what those tools did: the time, the tool, the action and whether it was attempted or completed. That can support follow up questions. It does not show that every use, or every secret, has been found. cybee does not find API keys, and it does not cancel or rotate keys at your clients’ services. The service that issued the access is where you check those changes. Saying so in the handover is practical: your client gets a clear owner and an honest record, instead of a vague promise that everything was removed. [What still needs a check at the service](https://cybee.ai/product/ai-agents/#permission-boundary)[Security for go to market agencies](https://cybee.ai/for/gtm-agencies/) Where cybee stops It maps the AI tools and connections on the Macs you enrolled. It does not find, cancel or rotate keys at the services that issued them, and it does not limit what an agent can reach. Choosing what each agent may reach is planned, not live. Free for every Mac The list of AI tools and their connections is part of the free plan, next to protection and the 118 checks. [See what the Proof plan adds](https://cybee.ai/pricing/). ## What to remember. - Map the workflows before you change their keys. - Keep secret values out of handover documents. - Check the cancellation at the service that issued the key, and write down any access that continues. ## Sources and further reading. Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup. - [Google Cloud: API key management](https://docs.cloud.google.com/docs/authentication/api-keys-best-practices) - [GitHub: removing sensitive data from a repository](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository) ## Plan for the next person who leaves. Accounts, shared files, keys, AI tools and Macs, with an owner for every check. [Work through a team change](https://cybee.ai/use-cases/team-changes/) On this page - The short answer - Start with what must keep working - Put the client in control - Replace access carefully - People, agents, jobs that run alone - The Macs are one part of the check - What to remember - Sources [Look up a term](https://cybee.ai/glossary/) cybee Shows which AI tools and connections sit on your team’s Macs. Free for every Mac. [See how it works](https://cybee.ai/product/) ## When someone leaves. Three more guides. [your team A freelancer leaves. What access do you remove? Accounts, shared files, AI connections, client keys and the handover record. Read the guide](https://cybee.ai/blog/contractor-offboarding-checklist/) [AI tools Which AI tools are on your work Mac? Find the assistants, their connections and the experiments nobody switched off. Read the guide](https://cybee.ai/blog/ai-tool-inventory/) [AI tools Is it safe to connect this tool to your AI assistant? Five checks before an AI assistant gets access to client files, a database or another business tool. Read the guide](https://cybee.ai/blog/mcp-server-security/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)