Get help without exposing a secret
Use the contact form for product questions, workspace setup problems, billing enquiries and security concerns. A useful message gives enough context to investigate without including the sensitive value itself. Do not submit passwords, API keys, authenticator seeds, recovery codes, payment-card details or complete one-time share links.
What information helps with a support request?
Describe the page you were using, what you expected to happen and the error message you saw. Include the approximate time with your time zone, browser name and whether the problem affects a personal account or a workspace. A redacted screenshot can help. Remove share-link fragments, access tokens, personal data belonging to other people and anything visible in browser storage or request headers.
How do I ask about billing or onboarding?
Tell us whether the issue concerns checkout, a renewal, cancellation or a missing workspace setup message. Include a non-sensitive invoice reference if you have one. Do not send a full card number or a screenshot containing payment credentials. Check your spam folder and confirm that you can receive messages at the email address used during checkout before requesting another setup email.
How should I report a suspected vulnerability?
Choose a clear security-related subject and describe the affected page, expected protection and observed result. Use only accounts and data you are authorised to test. Stop if a test exposes another person's information. Do not retrieve additional records, attempt destructive testing or publish sensitive details in the form. Ask us how to share any sensitive reproduction material safely before sending it.
What if a credential has already leaked?
First revoke or rotate the credential at the service that issued it. Removing an exchange or sending a support message cannot invalidate an API key, password or token at another provider. Check the provider's access logs and your organisation's incident-response process. Contact API Key Pro with a redacted description after taking the steps needed to stop further use of the exposed credential.
What does a safely redacted report look like?
For example: 'At approximately 10:15 New Zealand time, I signed in to my test workspace, opened the send screen and saw an expiry error before submitting a new message. I expected the form to remain available. I am using the current stable version of Firefox.' That description gives a sequence, time zone, expected outcome and browser without revealing a secret. Use a neutral label such as test-recipient instead of copying a real person's identifying details. If an error includes a URL, remove its fragment and query values before including it in your message.
How do I write a useful support message?
- Choose a specific subject and describe the account type or workspace involved without including login credentials.
- Write the steps that led to the problem, the expected result and the observed error.
- Redact screenshots and links, then review the message for secrets before submitting.
- For an exposed credential, rotate it at its source immediately rather than waiting for a support response.
Definitions and further reading
- Ciphertext
- The encrypted form of a message, rather than its readable plaintext.
- Credential rotation
- Replacing an existing password or token, and revoking the old value at its issuing service.
- One-time exchange
- A delivery mechanism that removes application access after consumption, not a guarantee against copying on the recipient's device.
These independent references explain the underlying concepts. They are not endorsements, certifications or an independent audit of API Key Pro.
- NIST: the Advanced Encryption Standard (FIPS 197)
- MDN: Web Crypto encryption and AES-GCM
- MDN: how URL fragments work
- OWASP: secrets management, rotation and revocation
Read our privacy policy and terms of service, or contact the team about a specific requirement.