Exposed Mailgun API Key? Here's how to detect and rotate it

A Mailgun API key (historically starting with key-) authenticates to the Mailgun API and can send email through your domains and read your account data. Anyone with it can send as you and pull your sending logs. Because the key controls your whole sending setup, a leak means you should rotate it right away.

What an attacker can do with a leaked Mailgun API Key

• Sends email through your verified domains, so spam and phishing go out with your reputation behind it.
• Reads your email logs — recipients, subject lines, and delivery events — exposing your customers' addresses.
• Pulls stored data like suppression lists, mailing lists, and bounce records tied to your account.
• Runs up sending volume and can get your domain throttled, suspended, or blocklisted by inbox providers.

How Mailgun API Keys get exposed

• Committed to a public repo in a .env file, config, or deploy script.
• Exposed in a client-side bundle or mobile app instead of being called from your server.
• Pasted into a screenshot, forum post, or support chat while debugging delivery.
• Captured in server logs or an HTTP trace that recorded the request auth.

How to rotate a leaked Mailgun API Key

1. Go to app.mailgun.com/settings/api_security and sign in.
2. Click the rotate (circular arrows) icon next to the private API key to generate a new one — the old key keeps working for 48 hours unless you expire it sooner.
3. Copy the new key, update your server environment or secrets manager, and redeploy.
4. Once your app is confirmed working on the new key, click the link to expire the old key immediately instead of waiting out the 48 hours.
5. Rotate your webhook signing key and SMTP credentials too if they were in the same leaked file, since they don't rotate with the API key.
6. Open Sending → Logs in the dashboard and review recent sends and recipients for mail you didn't send, then contact Mailgun support if you see abuse.

Open the Mailgun API Key dashboard →