To be honest, this wasn't a big problem for me when I was freelancing back in the day. I usually got the credentials over WhatsApp and asked them to remove the messages when I had them. If the client didn't know how to get the API key for a service, I would show them how to do it on Google Meet or call them.