Source Code

<div class="ak-wrap">
  <div class="ak-row">
    <div class="ak-label-block">
      <span class="ak-label">Secret API Key</span>
      <span class="ak-key" id="akKey">sk_live_\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u20223f2a</span>
    </div>
    <div class="ak-actions">
      <button class="ak-icon-btn" id="akToggle" aria-label="Show key" title="Show key">
        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M1 12s4-7 11-7 11 7 11 7-4 7-11 7-11-7-11-7z"/><circle cx="12" cy="12" r="3"/></svg>
      </button>
      <button class="ak-copy-btn" id="akCopy">Copy</button>
    </div>
  </div>
  <div class="ak-regen-block">
    <button class="ak-regen-btn" id="akRegenBtn">Regenerate key</button>
    <div class="ak-confirm" id="akConfirm" hidden>
      <span>Are you sure? This will invalidate the current key.</span>
      <div class="ak-confirm-actions">
        <button class="ak-confirm-btn" id="akConfirmYes">Confirm</button>
        <button class="ak-confirm-btn ak-confirm-cancel" id="akConfirmNo">Cancel</button>
      </div>
    </div>
  </div>
</div>

API Key Copy Field — Free HTML CSS JS Snippet

API Key Copy Field · Forms · Plain HTML, CSS & JS · Live preview

What's included

Features

navigator.clipboard.writeText() copies the real unmasked key regardless of the current show/hide display state
Copy button reverts from "Copied!" back to "Copy" after 1.5 seconds via a cleared and reset setTimeout
Eye-icon toggle reveals or re-masks the key, keeping only the prefix and last four characters visible when masked
Regenerate action gated behind an explicit inline Confirm/Cancel step rather than an immediate destructive action
Newly regenerated key automatically re-masks so it is not left accidentally exposed on screen
aria-label and title attributes update dynamically to reflect the current show/hide state for accessibility
Fully self-contained vanilla JS with no external dependencies

About this UI Snippet

API Key Copy Field — Masked Key With Clipboard Copy and Confirm-Gated Regeneration

Screenshot of the API Key Copy Field snippet rendered live

This snippet is a settings-panel row for displaying a secret API key: masked by default, revealable on demand, copyable to the clipboard with visible confirmation, and regenerable behind an explicit confirm step.

Masking and reveal

The key is stored in a fullKey variable. maskKey() keeps the sk_live_ prefix and the last four characters visible, replacing everything in between with bullet characters — showing just enough of the key for identification without exposing it. The eye-icon toggle button flips a revealed boolean and calls renderKey(), which chooses between the masked and full string based on that flag; the button's title/aria-label update between "Show key" and "Hide key" to match.

Copying with navigator.clipboard

The Copy button calls navigator.clipboard.writeText(fullKey) — note that it copies the real fullKey value regardless of whether the key is currently masked on screen, since masking is a display-only concern. On success, the button's label swaps to "Copied!" with a green background via a .ak-copied class. A setTimeout reverts it back to "Copy" after 1.5 seconds, and that timer is captured in copyResetTimer and cleared with clearTimeout at the start of every click — so clicking Copy again quickly restarts the 1.5-second window instead of the label flickering back early from a stale timer.

Confirm-gated regeneration

Clicking "Regenerate key" doesn't regenerate anything immediately — it only reveals a hidden confirmation block (toggled via the hidden attribute) with "Confirm" and "Cancel" buttons. Only clicking Confirm generates a new random key string, resets revealed to false so the freshly generated key isn't accidentally left exposed, and re-renders. Cancel simply hides the confirmation block again with no side effects.

Step by step

How to Use

  1. 1
    Load the snippetClick "API Key Copy Field" in the sidebar to load its HTML, CSS, and JS into the editor panels. The preview updates instantly.
  2. 2
    Edit the codeModify any panel — HTML, CSS, or JS. The preview refreshes as you type. Use Reset in each panel header to restore the original.
  3. 3
    Preview on devicesClick the Mobile (375px), Tablet (768px), or Desktop buttons in the preview header to check responsiveness.
  4. 4
    Export in your formatClick "HTML" to download a standalone file, "JSX" for a React component, "Tailwind" for a React + Tailwind CSS component, "Tailwind HTML" for a standalone HTML file with Tailwind CDN, "Vue" for a Vue 3 SFC with <template>/<script setup>/<style scoped>, or "Angular" for a standalone Angular .component.ts file. "Copy all" copies the full code to clipboard.
  5. 5
    Save your versionClick "Save as", type a name, and press Enter. Your snippet saves to IndexedDB and appears in the Saved tab.

Real-world uses

Common Use Cases

Developer settings and API dashboards
The standard pattern for displaying and managing secret keys or tokens in a settings page.
Reference for the Clipboard API
A clean, minimal example of navigator.clipboard.writeText with visible copy confirmation and timeout reset handling.
SaaS admin panels
Drop directly into an integrations or API access settings screen.
Teaching confirm-gated destructive actions
Demonstrates a lightweight inline confirm pattern without a modal dialog.

Got questions?

Frequently Asked Questions

It always copies the real fullKey value via navigator.clipboard.writeText(fullKey), regardless of whether the key is currently shown masked or revealed on screen — masking only affects what is displayed, not what gets copied.

Each click clears the previous copyResetTimer with clearTimeout before starting a new 1.5-second setTimeout, so the "Copied!" label's revert is always measured from the most recent click rather than potentially reverting early from an earlier, still-pending timer.

No — it only shows an inline confirmation block with Confirm and Cancel buttons. The new random key string is only generated when Confirm is explicitly clicked; Cancel dismisses the confirmation with no changes.

The confirm handler resets the revealed flag to false before re-rendering, so a freshly generated key is not left visibly exposed on screen by default — the user has to explicitly click Show again to view it.