How do you securely hand off API keys and environment variables to a client without it ending up in a Slack DM or email?

This used to be a mess for us. A project wraps up, or a client needs to plug in their own payment gateway or analytics key, and the "secure" method was usually pasting it into Slack and hoping nobody screenshots it or it doesn't sit there forever in searchable history.

We started using 1Password's shared vaults specifically for this handoff moment, a temporary vault scoped just to that client, containing only the keys they need at project handoff, shared with a single guest login that expires once the project closes out. No more permanent access lingering after the engagement ends, and no more digging through old messages trying to remember where a key was last shared.

The part that took some setup was getting the expiration/offboarding habit actually consistent across the team, it's easy to create the vault and forget to close it out later. We ended up adding a "revoke access" step to our own project closeout checklist so it doesn't get skipped.

Curious how other teams handle this specific moment, the handoff to a client or contractor who only needs access temporarily, not permanently. Do you use guest accounts, a separate workspace entirely, or something else? We're a small agency, and this is the part of client offboarding that's easiest to let slip.