A Mailchimp API key gives whoever holds it the access of the account user who created it. The key has no scopes: it can read your audiences and subscriber details, export them, create and send campaigns, and change account settings. That makes a leak a data incident (your subscribers’ email addresses) and a reputation risk (a phishing campaign sent from your sender identity). It does not reach your servers. Disable the key first, then audit what it could do.
Check your GitHub account for leaked secrets — free
- Provider
- Mailchimp
- Severity
- High
- Impact
- SaaS account access and billing
- Checked live by LeakWatch
- No
What a Mailchimp API key looks like
A Mailchimp key is 32 lowercase hexadecimal characters, a dash, and a data-center suffix such as us followed by two digits:
…XXXX-usNN Mailchimp API key (masked: 32 hex characters, dash, data-center suffix)
The suffix after the dash tells you which Mailchimp server your account lives on, and it is also the first part of the API host name. That suffix is the one distinctive part, but the 32-character body has no prefix, so a bare string found alone is not enough to attribute it with confidence. The variable that holds it is usually MAILCHIMP_API_KEY. Do not confuse it with a Mailchimp Transactional (Mandrill) key, which is a different product and has a different format.
How Mailchimp API keys get leaked
- Hardcoded in a newsletter script. A sign-up form handler or import job with the key typed in.
- Committed environment files.
MAILCHIMP_API_KEYin a.envfile or a CMS plugin configuration. - Front-end code. A signup widget that calls the API from the browser, shipping the key to every visitor.
- Plugin and theme exports. A website backup, a theme repository or a plugin settings export that includes the integration key.
- Support threads. A key pasted into a ticket, an issue or a screenshot while asking why a sync fails.
What to do in the first hour
- Find the key in your account. In the account’s Extras area, open the API keys page (see the link below). The list shows each key’s label, creation date and last-used information, which helps spot an unexpected user.
- Create a new key with a label that names the service it will serve, and keep one key per integration.
- Deploy the new key to the application or secret store, and confirm that a request to the API still works.
- Disable or delete the exposed key from the same list. Disabling is reversible, deleting is permanent; for a leaked key, pick whichever you are sure you will not need to reverse.
- Audit your audiences. Check for exports you did not request, subscribers added or removed in bulk, and changes to audience settings or merge fields.
- Audit campaigns and automations. Look for campaigns or automations you did not create, changed sender addresses and reply-to settings, and anything sent or scheduled recently.
- Check the account users. Review the user list and each user’s keys. The key belongs to a user, so the account’s team members and their roles matter. See I accidentally pushed an API key to GitHub.
Not sure what else leaked from the same repository? Run a free scan.
Revoke it at Mailchimp
Mailchimp keys are managed from the API keys page of your Mailchimp account, reached from the account menu under the extras section, after you sign in as the user who created the key or an administrator. Select the exposed key and disable or delete it. Keys belong to individual users, so a key created by someone else will appear under their login. A person has not confirmed the exact menu wording for this guide, and the interface can change, so if what you see differs, look for the page where API keys are created, and follow Mailchimp’s documentation.
How LeakWatch detects it
The rule is called Mailchimp API Key. Because the key body has no prefix, the rule does not match a bare string: it looks for the word mailchimp (or MailchimpSDK.initialize) in front, followed by a separator such as = or :, and then 32 lowercase hexadecimal characters, a dash, us and two digits. A key that appears without that context, or with a different data-center suffix, is not reported. The severity is high. This type is not checked live: LeakWatch does not send any request to Mailchimp with the key it found.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Can someone email my subscribers with this key?
Yes, if the key belongs to a user allowed to create and send campaigns. Check your campaigns and automations for anything you did not create, and contact Mailchimp if mail was sent in your name.
Do I need to tell my subscribers?
If subscriber data was exported or read by a stranger, you may have notification duties under data-protection law. This is a decision for a qualified adviser, with the audit results in hand.
Does the dash and suffix mean the key is safe to share?
No. The suffix only names the server. The 32-character body is the secret, and the whole string is needed for the API, so treat all of it as sensitive.