A leaked API key
Contain an exposed Mailfully key: rotate or revoke it from the dashboard, then audit what it could reach.
Decide whether to rotate or revoke, then audit what the key could reach.
Decide: rotate or revoke
| Situation | Action |
|---|---|
| Accidental commit in a private repo you control | Rotate, redeploy with the new key, then revoke the old key once the new one is live everywhere. |
| Public repo, published client bundle, or any exposure you cannot bound | Revoke immediately, even if you already rotated. |
Rotating keeps the old key working for 24 hours; revoking it ends that at once.
Rotate
Open API keys, click Rotate on the key, then Rotate key in the dialog. Copy the new secret from the Your new API key dialog. It is shown once. The new key keeps the old key's name, scopes and environment.
Only a key that has not been revoked or rotated can be rotated. Rotation and revoking need a dashboard session, so an mf_ key gets 403 on these endpoints. See Rotate an API key.
Revoke
Open API keys, click Revoke on the key, then Revoke key. The key fails on its next call with 403 invalid_api_key ("This API key has been revoked."). Anything still using it breaks. See Revoke an API key.
Audit what it did
Sends are not tagged with the key that made them. Look for unfamiliar from addresses, recipients or subjects since the exposure. Check your domains and templates too: a key with send can add and delete domains, turn receiving on or off, and create, change and delete templates. A volume spike shows in Analytics. GET /v1/emails, GET /v1/domains and GET /v1/templates all work with an API key:
curl "https://api.mailfully.com/v1/emails?limit=100" \
-H "Authorization: Bearer mf_live_xxxxxxxxxxxx"See GET /v1/emails, GET /v1/domains and GET /v1/templates.
Clean up the exposure
Rotating or revoking does not remove the secret from git history or a log service. Clean those up separately. API key security covers where to store a secret and how to keep scopes narrow.