Leaked Brevo API Key? Delete It and Check Sends

A Brevo API key lets whoever holds it call the Brevo API as your account. That covers sending transactional and marketing email from your sender domains, reading and changing contact lists, and managing templates and campaigns. Sent mail goes out under your name and domain, so the damage lands on your reputation and your recipients, not only on your account. Delete the exposed key, create a replacement, then check what was done with the old one.

Check your GitHub account for leaked secrets — free

Provider: Sendinblue
Severity: High
Impact: SaaS account access and billing
Checked live by LeakWatch: No

What a Sendinblue (Brevo) API key looks like

A Brevo API key starts with a fixed prefix, xkeysib-, followed by a long random body of letters, digits, underscores and hyphens. Masked, it looks like this:

xkeysib-…XXXX   Brevo API key (masked)

The prefix is specific enough that a hit is rarely a false alarm. Brevo also issues SMTP keys, which carry a different prefix and are used as the password for SMTP logins. An SMTP key cannot call the REST API, and an API key cannot be used as the SMTP password, so check which one you actually have before you change anything. If a file holds both, handle both.

Brevo’s documentation sends API calls with the key in an api-key request header. If you find that header name next to a value that starts with the prefix above, the leak is almost certainly a live Brevo key, and it should be treated that way even if the body looks shorter than you expected in a partial copy.

How Brevo API keys get leaked

Mail helpers and SDK setups. A configuration file for a transactional mail helper, committed with the key in it and not read from the environment.
Environment files. A .env file that holds the key next to database passwords, with no entry in .gitignore.
Front-end code. A signup form or a script that calls the API directly from the browser. The key then ships to every visitor, which is a common mistake with marketing tools.
Integration scripts. A sync job that copies contacts from a CRM or a shop into Brevo, with the key written into the script for convenience.
Logs and support requests. A request dump that prints the api-key header, pasted into an issue or a chat thread to ask for help.

What to do in the first hour

Create a replacement key first. In Brevo, go to Settings, then SMTP & API, and open the API keys tab. Generate a new key, give it a name that says which application uses it, and copy it at once. Brevo shows the value only once, so store it straight in your secret manager.
Deploy the new key. Update the application’s environment variables or secret store, restart the service, and send one test message to an address you control. Make sure the message arrives with the right sender address.
Delete the exposed key. On the same page, select the old key and delete it. Brevo treats deletion as permanent, and calls that use the old value stop working from then on. Confirm the integration is running on the new key before you delete, so that you do not cause an outage you did not plan.
Check sent mail and campaigns. Open the statistics and transactional logs for the period since the exposure. Look for messages you did not write, new campaigns or templates you do not recognize, and a sudden rise in volume or in spam complaints. Check the sender list too, because a new sender address is an easy way to send mail that looks official.
Check contacts and lists. Look for imports or exports you did not start, new lists, and contacts that were added in bulk. Exporting a full contact list is a common goal of an attacker, so pay attention to any export activity.
Review the account’s users and other keys. Only the account owner and users with the API keys permission can manage keys. Check who holds those permissions, and remove any key that nobody can name an owner for. Brevo emails the account owner when keys are created or deleted, so make sure that mailbox is read by someone.
Clean the repository. Remove the value from the code and, if you want the old copy gone from history, rewrite it. See I accidentally pushed an API key to GitHub.

Not sure what else leaked? Run a free scan.

Revoke it at Brevo

Brevo API keys are managed from the SMTP & API section of your account settings. Open the API keys tab, which is listed as API Keys and MCP in recent versions of the interface, find the key by its name, and delete it. Only the account owner and users with the API keys permission can do this, so if you cannot see the page, ask the owner to delete it for you or grant you the permission. Admin accounts on Brevo’s enterprise plans manage keys from a separate API tab, with similar steps.

Deleting an API key is permanent, and Brevo deactivates keys that have not made a successful call in 90 days even when they have no expiry date. Deletion does not fix the code that still holds the old value, so update every system that used it. SMTP keys are managed separately, under the SMTP tab of the same page, and creating one needs a verification step, so delete any SMTP key that matches the leak as well.

How LeakWatch detects it

The rule is called “Sendinblue (Brevo) API Key”. It looks for the literal prefix xkeysib-, followed by exactly 81 characters made of letters, digits, underscores and hyphens, bounded by a word boundary on both sides. The fixed prefix and the fixed length together make a false positive unlikely, so a match is usually a real key. The severity is high, and the impact class is software-as-a-service, because the key controls email sending and contact data in your account. This type is not checked live: LeakWatch does not send any request to Brevo with the key it finds, so a reported key may already be deleted.

LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.

FAQ

Can someone read my contacts with this key?

Yes, if the key can read or export contact data. The key itself does not say what it is allowed to do, so assume it can, and check the export and activity logs for the period since the exposure. Then delete the key.

If the key was only public for a few minutes, do I still need to delete it?

Yes. Automated scanners watch public repositories all the time, and a deleted key costs you a few minutes while a misused one can cost you your sender reputation. Delete first, then check the logs to see whether the key was used.

Why does my SMTP login stop working after I delete an API key?

Because the API key and the SMTP key are different credentials. Deleting an API key does not change SMTP logins, and deleting an SMTP key does not change API calls. If you rotated the wrong one, the integration that uses the other one keeps running, so check each integration and replace the credential it actually uses.