On this page
How should an agency hand over client API keys securely?
List every client key your team uses, the jobs that depend on it and the person who owns it. Agree which access continues after the handover. Then replace or cancel the keys nobody needs at the service that issued them, update the workflows that should keep running and check the result.
Deleting a local file does not cancel a key.
What is an API key?
What an API key is.
A long secret that lets a program use a service in someone’s name, such as a CRM, an email tool or a database. Whoever holds the key can use that access.
It keeps working until the service that issued it cancels it, however many copies exist.
What does revoking a key mean?
What revoking a key means.
Cancelling it at the service that issued it, so it stops working everywhere at once. Rotating means you create a new key first, move the work to it, then cancel the old one.
Deleting the key from a file, a laptop or a chat does neither. The key still works.
Start with the automations that must keep working.
The campaign is finished, but a lead routing script still runs every morning. The client’s CRM key also lives in a freelancer’s automation account. An assistant has a connector to the same system. A good handover starts with these working relationships, because changing a key before you understand them can interrupt your client’s business.
Make one record for each service: the client’s owner, the purpose, the account or key name, the permissions, the place where it is stored and the workflow that depends on it. Include hosted automation platforms as well as laptops. Do not put the secret itself in the record, a ticket or a shared document. You need a map of access, not one more place that holds the keys.
You need a map of the keys. Not one more place that holds them.
Put the client in control of the lasting setup.
Your client should know who owns the account that runs an essential workflow. If it runs inside your agency’s own account, decide what happens to it: move it, rebuild it in the client’s account or keep managing it under a clear agreement. Check what the service allows before you promise a move between organisations without an interruption.
Keep production work apart from experiments. A test connector from a pitch should not quietly become the permanent way into a client’s CRM. Where the provider allows it, use a separate key for each job and give each key only the access that job needs. A later change is then easier to follow, and it breaks less.
client handoverthree steps
A handover that keeps work running.
- 1
Map.
Find every workflow that depends on the key: scripts, automation accounts, AI connectors.
- 2
Replace.
Test the new access your client owns, in an agreed change window, with an owner on each side.
- 3
Retire.
Cancel the old key at the service, then check that the old route no longer works.
Replace access without breaking the workflow.
For a planned handover, agree a change window and an owner on each side. Follow the provider’s process to create the new access, update the workflows that should keep running and test one real job. Then cancel the old key and check that the old route no longer works. Some services rotate keys in a different order, so follow their documentation.
If a key has been exposed, treat that as an incident. Do not wait for the next planned handover. GitHub’s guidance puts cancelling or rotating the key first when a secret was committed to a repository. Deleting the visible text does not remove the access it grants. Keep the useful details of the incident, without spreading the secret into more messages.
Provider guidance: Google Cloud: API key management · GitHub: removing sensitive data from a repository
Check the people, the agents and the jobs that run alone.
Ask everyone who worked on the project which tools they connected. Look at editor integrations, AI assistants, deployment services and scheduled automations. Someone leaving a Slack channel does not mean their other access has ended. The same goes for cancelling an agency seat while a shared key still sits in an outside workflow.
Finish with a short handover record: what stays active, who owns it, which keys were replaced, when the old access ended and what still needs a decision. Ask your client to confirm the workflows they rely on. Keep any exception visible, especially if support access continues after the final invoice.
handover record26.09.2026
| Service and job | Owner from now on | Old access |
|---|---|---|
| CRMlead routing script, every morning | The client, in their own account | Replaced. Old key cancelled and checked. |
| CRM support loginagreed support after the project | Your agency, under a written agreement | Still active. Continues after the final invoice. |
| Research connectorin an AI assistant, from the pitch | Nobody | Removed. Key cancelled at the service. |
No key values in this record. Only where each key is managed, and by whom.
Use the view of the Macs as one part of the check.
cybee shows the AI tools installed on your team’s Macs and the connections set up in them. That gives the handover a useful place to start: which tools did this person connect? cybee also records what those tools did: the time, the tool, the action and whether it was attempted or completed. That can support follow up questions. It does not show that every use, or every secret, has been found.
cybee does not find API keys, and it does not cancel or rotate keys at your clients’ services. The service that issued the access is where you check those changes. Saying so in the handover is practical: your client gets a clear owner and an honest record, instead of a vague promise that everything was removed.
What still needs a check at the service Security for go to market agencies
What to remember.
- Map the workflows before you change their keys.
- Keep secret values out of handover documents.
- Check the cancellation at the service that issued the key, and write down any access that continues.
Sources and further reading.
Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup.
Plan for the next person who leaves.
Accounts, shared files, keys, AI tools and Macs, with an owner for every check.
