uSend Docs
Guides

Handling leaked API keys

What to do within minutes if an API key was exposed.

If a key ended up in a public repository, a log, a screenshot or a former colleague's laptop, assume someone has it. Act first, investigate after.

1. Delete the key

Open API Keys in the dashboard and delete it, or call DELETE /api-keys/{id} with another key. A deleted key stops working immediately, for the API and for SMTP. You may need to create a new one first so your application keeps sending: create the replacement, deploy it, then delete the old key.

Shell
curl -X DELETE https://api.usend.et/api-keys/KEY_ID \
  -H "Authorization: Bearer $OTHER_FULL_ACCESS_KEY"

2. Look at what the key did

  • Logs in the dashboard list every request with the key's name, time, IP address, user agent and status. Filter by the key (api_key_id) and look at what happened since the leak.
  • Emails shows what was sent. Unknown recipients or subjects are a sign of abuse.
  • A full_access key can also have changed domains, webhooks, contacts or other keys. Check Webhooks for endpoints you do not recognize, and API Keys for keys you did not create.

3. Stop the damage

  • Remove unknown webhook endpoints and API keys.
  • If someone sent spam with the key, expect complaints and bounces. Watch your rates. usend suspends an organization above 4% hard bounces or 0.08% complaints, and reviews it with you.
  • If abuse happened, write to [email protected] with the details. Early contact lets the team help before a suspension.

4. Clean up where it leaked

  • If it was committed to Git, rotating the key matters more than rewriting history: assume the old key is public forever. You can still remove it from history to avoid confusion.
  • Remove it from logs, tickets, chat messages and screenshots.
  • If it was in a public repository, expect automated scanners to have found it within minutes.

5. Prevent a repeat

  • Use sending_access keys limited to one domain: a leak then cannot read data or manage settings.
  • Keep keys in a secrets manager: Handling API keys.
  • Turn on your Git host's secret scanning; usend keys start with us_.
  • Rotate on a schedule.

Webhook secrets

If a webhook signing secret leaked, anyone could forge events to your endpoint. Create a new webhook with a new secret, switch your endpoint to it, and delete the old one. See Verify signatures.