Ballmac UI home

API Key Field

Displays a secret such as an API key, masked by default (sk-live-••••••••a1b2), with a reveal toggle, a copy button that copies the full key, and an optional regenerate action.

Secret key
sk-live-, rest hidden, ends in a1b2

Created Sep 28, 2026. Keep it on your server.

Installation

$ pnpm dlx shadcn@latest add @ballmac/api-key-field

Usage

import { ApiKeyField, maskSecret } from "@/components/ballmac/api-key-field"

The full example is in the Code tab above.

API reference

PropTypeDefault
value*

The secret. It is only rendered in full while revealed and is never logged.

string—
label

Visible label, also the accessible name of the group.

React.ReactNode—
description

Helper text under the field, e.g. when the key was created.

React.ReactNode—
visiblePrefix

Leading characters left visible while masked, e.g. 8 keeps "sk-live-".

number8
visibleSuffix

Trailing characters left visible while masked.

number4
revealed

Controlled reveal state.

boolean—
defaultRevealed

Initial reveal state when uncontrolled.

booleanfalse
onRevealedChange

Called when the reveal toggle is pressed.

(revealed: boolean) => void—
onCopy

Called after the full key was copied to the clipboard.

() => void—
onRegenerate

Shows a regenerate button. Asking for confirmation is up to you.

() => void—
regenerating

Disables the regenerate button and spins its icon while a new key is created.

booleanfalse

Also accepts the standard attributes of its root element.

Accessibility

KeyAction
TabMoves between reveal, copy and regenerate buttons
Enter / SpaceReveal is a toggle button (aria-pressed); copy announces 'Key copied to clipboard'
—While masked, screen readers hear the prefix and last characters, not bullet characters

Use with AI

Show an existing secret: <ApiKeyField value={key} label='Secret key' onRegenerate={confirmThenRotate} />. It is read-only; copy always copies the full value, even while masked. With the shadcn MCP server set up (guide), ask your agent:

Add the Ballmac UI API Key Field (@ballmac/api-key-field) to this project with the shadcn MCP, then use it where it fits.

Use it for

  • API keys, webhook signing secrets and access tokens on settings or developer pages
  • Showing a newly created key once so the user can copy it

Not for

  • Password entry (use an input with type=password)
  • Secrets you should not send to the browser at all (show only the last four characters from the server)

Registry JSON: https://ui.ballmac.com/r/api-key-field.json

Credits

Free to use in personal and commercial projects.