API key security
Store, rotate and revoke MailGraf API keys without exposing account access.
An API key can access the public API for its MailGraf account. MailGraf does not currently support narrower permissions per key, so treat each key like a password and give it a clear owner.
Limit each key's use
- Create a separate key for each service and environment, such as
CRM productionandCRM staging. - Keep the key in a secret manager or protected server environment variable.
- Never put it in browser code, a mobile app, a public repository, a support ticket or a screenshot.
- Remove keys that are no longer used. The Last used value and API request monitor help you identify active keys.
Only account owners and administrators can manage API keys. A key grants API access to its account, not to the user who created it.
Rotate a key safely
Create a replacement key
Open Settings > API keys, click Create API key and use a name that identifies the service and environment.Update the receiving service
Replace the old key in the service's secret configuration and deploy the change.Confirm the new key is in use
Send the read-only request from Send your first API request. Check Last used or the API request monitor before removing the old key.Revoke the old key
Open the old key's menu and click Revoke. Requests using it begin returning 401 immediately.
Respond to an exposed key
Revoke the key as soon as you suspect it has been copied or published. Do not wait to find out whether it was used. Create a replacement, update the affected service and review the API request monitor for unfamiliar resources, IP addresses or response codes.
Revocation is permanent
The Revoke action cannot be undone. Confirm that the replacement is working before planned rotation, but revoke first when a key may have leaked.
Where the full reference lives
The API reference documents the bearer authentication contract and the errors returned by every endpoint.
Frequently asked questions
Can I retrieve the full key later?
No. MailGraf shows the full key once, when it is created. The API keys page keeps only a short prefix so you can identify it.
Can I undo a revocation?
No. Revocation takes effect immediately and cannot be undone. Create a new key if the service still needs access.
Can several services share one key?
They can, but a separate key for each service and environment makes monitoring and revocation safer.
Related articles
Was this helpful?
Still need help?
Write to us and a person will answer.