To hide API keys when you share your screen, keep secrets out of what you show, share one window instead of the whole screen, and mask key formats automatically before they appear. In the browser, BlurPilot , a Chrome and Edge extension by Cirrabit, recognizes common formats such as sk_live_ , ghp_ , AKIA and xoxb- , plus long random tokens, and blurs them on your device. If a key does appear on screen, treat it as leaked: revoke and rotate it right away.

Key takeaways

A key that appears on a shared screen is a leaked key. A recording, a screenshot or a paused live stream keeps it readable.

Most leaks come from the edges of the demo: the environment-variable page, the terminal history, a log line, the network tab.

Layer the defenses: scoped demo credentials, window-only sharing, automatic masking in the browser and a checklist before every call.

If a key leaks, revoke it first and investigate second, even while the call is still running.

Why a key on screen counts as a leaked key

An API key is a…