Best practice for using Spark with another dev

I have a project I'm working on with a developer and I have just bought Laravel Spark to use on it.

I can create an auth.json for storing my login creds but using an API key instead of password. The recommendation is to not put the auth.json into version control.

What is considered best practice for allowing the other developer to do the installation of libraries etc. Without just committing my auth.json.

Im guessing the recommendation will be create a second API key for the other dev to use (that can be revoked if we stop working together) and they create their auth.json but I thought I would ask in case there was something other, more experienced developers, would suggest as a better way of doing things.

Thanks for any thoughta/suggestions.

Satal