The short answer
To hide API keys when you share your screen, keep secrets out of what you show, share one window instead of the whole screen, and mask key formats automatically before they appear. In the browser, BlurPilot, a Chrome and Edge extension by Cirrabit, recognizes common formats such as sk_live_, ghp_, AKIA and xoxb-, plus long random tokens, and blurs them on your device. If a key does appear on screen, treat it as leaked: revoke and rotate it right away.
Key takeaways
- A key that appears on a shared screen is a leaked key. A recording, a screenshot or a paused live stream keeps it readable.
- Most leaks come from the edges of the demo: the environment-variable page, the terminal history, a log line, the network tab.
- Layer the defenses: scoped demo credentials, window-only sharing, automatic masking in the browser and a checklist before every call.
- If a key leaks, revoke it first and investigate second, even while the call is still running.
Why a key on screen counts as a leaked key
An API key is a password for a machine. Anyone who can read it can use it until it is revoked. On a live call every participant can take a screenshot; in a recording every viewer can pause on the frame, zoom in and copy the characters one by one.
Secrets already leak at scale through code. GitGuardian's State of Secrets Sprawl 2025 report counted 23.8 million new secrets exposed in public GitHub commits in 2024, 25% more than the year before, and found that 70% of the secrets leaked in 2022 were still active. Leaked keys stay useful for a long time because rotating them is work that keeps getting postponed.
Screen shares are a channel no scanner watches. Secret scanning on your Git host catches a key that gets committed; nothing catches a key shown on a sales call, a pair-programming session, a conference talk or a live stream. And mistakes are not rare: Verizon's 2025 Data Breach Investigations Report found a human element in about 60% of the breaches it analyzed. Prevention has to happen on the screen itself.
Where secrets show up during a screen share
It is rarely the file you meant to open. These are the places keys appear most often when developers present, pair or stream:
| Where | What appears | Typical moment |
|---|---|---|
| Provider dashboards | Live and test API keys, webhook signing secrets, “reveal” and “copy” buttons | Showing how to set up an integration |
| Environment-variable pages | Values in hosting and CI settings, often one click from visible | Debugging a deploy on a call |
Editor and .env files | Hard-coded keys, connection strings, private keys | Opening the wrong file during a code walkthrough |
| Terminal | Exported variables, shell history, curl commands with bearer tokens | Scrolling up, or pressing ↑ to rerun a command |
| Logs and observability | Authorization headers, session IDs, tokens in URLs | Investigating an incident live |
| Browser DevTools | Request headers, cookies, local storage | Explaining an API call in the network tab |
| Chat and tickets | Keys pasted into Slack threads or issue comments | Searching history for “the key from last week” |
The pattern is the same every time: the thing you are showing is safe, and the thing next to it is not.
How to keep API keys off a shared screen
1. Before the call: give the demo its own credentials
The safest key to show is one that cannot do damage. Create a separate demo project or account with test-mode or restricted keys, scoped to the minimum permissions and easy to rotate. Payment providers separate test and live keys for exactly this reason: a Stripe sk_test_ key cannot move real money. Still, do not show test keys on purpose; they open your test data, and habits travel.
Move real secrets into a secrets manager or your platform's encrypted variables, so code refers to them by name and they never sit in files you might open on stream.
2. At the start: share a window, not the whole screen
Zoom, Google Meet and Microsoft Teams all let you share a single window or browser tab instead of the entire desktop. That keeps notifications, password managers and other apps out of the picture. It does not protect anything inside the window you share, which is where the next layer comes in.
Clear the terminal before you share it, open a fresh shell so the history is empty, and keep .env files closed. For browser demos, use a separate browser profile that is not signed in to production accounts.
3. During the call: mask keys automatically in the browser
Most of a developer's risky screens are web pages: cloud consoles, payment dashboards, CI settings, log viewers. BlurPilot reads those pages on your device and blurs secrets before they reach the shared screen. With API key detection on (a Pro feature), it recognizes:
- Payment keys: Stripe
sk_live_,rk_live_andpk_live_keys and their test-mode versions, Stripe webhook secrets (whsec_), plus Square and Paddle keys - Code hosts: GitHub tokens (
ghp_,gho_,ghu_,ghs_,ghr_,github_pat_), GitLab (glpat-) and npm (npm_) tokens - Cloud and AI: AWS access key IDs (
AKIA,ASIA), Google API keys (AIza), OpenAI (sk-,sk-proj-) and Anthropic (sk-ant-) keys - Messaging and commerce: Slack tokens (
xoxb-,xoxp-,xapp-), SendGrid keys and Shopify access tokens - Everything else: JSON Web Tokens, PEM private-key blocks, UUIDs used as customer and session IDs, and long random strings that score high for entropy
Two details keep developer tools readable. On a site full of commit hashes, such as a Git host, you can allow-list the site so only known prefixes blur and diffs stay legible. And version strings such as 1.2.3.4 inside code blocks are not mistaken for IP addresses.
The paste guard covers the other direction: while Presenter Mode is on, BlurPilot asks before an API key is pasted into a web field, so it never lands on screen in the first place. Detection runs locally and page content is never uploaded; the security overview lists every network call.
4. Know the limits
A browser extension can only see web pages. Your terminal, a desktop IDE and other native apps are out of its reach, and so is text a web app draws on a canvas, which some web terminals do. For those, rely on window-only sharing, a clean shell and demo credentials, and test with a second device watching the share.
Key prefixes worth recognizing on sight
Many providers put a fixed prefix on their secrets precisely so that people and scanners can spot them. Knowing the common ones helps you notice a key before your audience does:
| Prefix | Provider | What it is |
|---|---|---|
ghp_ | GitHub | Personal access token (classic) |
github_pat_ | GitHub | Fine-grained personal access token |
gho_ ghu_ ghs_ ghr_ | GitHub | OAuth, user-to-server, server-to-server and refresh tokens |
AKIA | AWS | Access key ID of a long-term key for an IAM user or the root user |
ASIA | AWS | Access key ID of temporary credentials issued by AWS STS |
sk_live_ rk_live_ | Stripe | Secret and restricted keys in live mode |
pk_live_ | Stripe | Publishable key, designed to be used in browser code |
xoxb- xoxp- | Slack | Bot token and user token |
eyJ | Any | Start of a JSON Web Token: the base64 encoding of {" |
An AWS access key ID on its own is not the secret, but it identifies the account and is usually stored and displayed next to the secret access key, which has no recognizable prefix at all. That is why prefix lists are not enough on their own, and why BlurPilot also scores long random strings for entropy.
What to do if you leak an API key on a screen share
Assume it was seen. Then work through these steps in order, during the call if you can:
- Revoke or rotate the key now. In most dashboards the button says roll, regenerate, deactivate or delete. Rotation takes minutes; waiting until the call ends gives a viewer that long to use it.
- Deploy the replacement. Update the secret everywhere it is used, then confirm the old one now fails.
- Check the logs for the exposure window. Review the provider's audit or access logs (for AWS, CloudTrail) from the moment the key was shown until it was revoked, and look for calls you do not recognize.
- Contain the recording. Stop or delete cloud recordings, trim the published video and ask attendees to delete screenshots. Assume a copy exists anyway; that is why rotation comes first.
- Write it down. Record what was shown, to whom, for how long and what you did. If the key could reach personal data, bring in your privacy lead: see whether a screen-share slip is a GDPR breach.
- Fix the cause. Save a blur rule for that page or make the site always-on, so the same screen cannot leak on the next call.
A 60-second pre-call checklist for developers
- Demo project and scoped test keys ready; production consoles closed.
- Fresh terminal session; no
.envor config files open. - Do Not Disturb on; chat apps closed or muted.
- BlurPilot Presenter Mode on (Alt+Shift+H), red badge visible, API key detection enabled.
- Share a window or a tab, not the entire screen.
- Recording? Watch the first minute back before you publish.
Frequently asked questions
Is it safe to show an API key if I delete the recording afterwards?
No. Anyone on the call could have taken a screenshot, and viewers can record a live stream themselves. Deleting the recording limits further exposure but does not make the key secret again. Revoke and rotate it.
Can I blur an API key in the video after recording?
You can, but rotate the key anyway. Blur and pixelation are not reliable redaction: in 2022 the security firm Bishop Fox released Unredacter, a tool that recovered pixelated text. If you edit a recording, cover secrets with an opaque block, and treat any key that was ever visible as compromised.
Is a Stripe publishable key (pk_live_) safe to show?
Publishable keys are designed to sit in browser code, so showing one is low risk. They still identify your account, and BlurPilot blurs them along with secret keys, so you never have to judge which kind is on screen in the middle of a demo.
Does BlurPilot upload my pages to detect keys?
No. Detection runs inside your browser with regular expressions and validators. Page content, URLs, rules and custom words are never sent anywhere; the only routine network call is a daily license check.
Does BlurPilot hide keys in my terminal or desktop IDE?
No. It works on web pages in Google Chrome and Microsoft Edge. For native apps, share a single window and use a clean shell and demo credentials. Browser-based tools are covered when their text is real page text rather than drawn on a canvas.
Which BlurPilot plan detects API keys?
API key, token, IBAN and IP address detection are part of Pro: $4 a month, $24 a year or $49 once. Every install starts with a 7-day Pro trial with no email or card, and the Free plan keeps blurring emails, phone numbers and card numbers after it ends.