Whenever you can, enter a credential yourself instead of sending it. Keys for your own site, such as a Stripe key or a Google Maps key, go into your own HomeRunner settings or dashboard, and nobody at HomeRunner needs to see them. Sending a credential is only for cases where the HomeRunner team has to enter it for you, for example when you do not have a dashboard login or when a PMS connection is set up by HomeRunner.
Why not email or chat. A credential never belongs in the body of an email, a chat message, a support ticket or a shared document. Those copies stay in inboxes and histories long after the setup is done.
Sending a credential. Use a one-time secret link instead:
- Go to https://onetimesecret.com/ and create one secret per credential. Set a passphrase on each one.
- Email only the links to your HomeRunner contact, with nobody else in copy. A one-time link is destroyed the first time it is opened, so a link in a group thread is gone the moment anyone clicks it.
- Deliver the passphrase through a different channel, for example a text message to the number your contact gave you.
- Your contact confirms receipt on the thread. If a link had already been opened before they reached it, rotate that credential in your PMS or Stripe console and create a fresh link.
Use a dedicated key where possible. Where the service offers it, create a dedicated or restricted key for HomeRunner rather than reusing your main one. You can then rotate or revoke it at any time without affecting anything else.
Receiving a credential from HomeRunner. When the HomeRunner team sends you a credential, such as a WordPress login or a key HomeRunner generated, it arrives as a link at secrets.homerunner.io. Opening the page does not reveal anything yet. Click Reveal secret, copy the value straight into where it belongs, and treat the link as spent: it can be revealed once and it expires after seven days. If the page says the secret is no longer available, it was already viewed or it expired, so ask your contact for a fresh link.