Sharing API keys with a contractor without leaking them into shared docs

Contractors need credentials to do their job, but paste an API key into Slack or a Google Doc and it lives there indefinitely. Here's a practical work...