I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are:
- PGP: I could share our public key with the third-party application owner, who could send us the access token for their API. However, from experience I've noticed the person on the other end is often not familiar with PGP and has neither the time or the knowledge how to sent via PGP properly.
- Using an AES-256 encrypted zip over mail, and sending the zip password over another communication channel (e.g. in a text): This has the benefit of protecting the secret token from a mail compromise, and having a lower 'technical threshold' for third-party application owners.
I've looked for this in the NIST 800 guidelines without much success..
Are there other methods I'm overlooking, or is there an official source that can confirm these proposed methods as being the "industry standard"?