# Leaked Mailchimp API Key? Disable It, Check Lists > Mailchimp API key exposed on GitHub? Disable it, create a new one, and audit audiences, campaigns and exports. Step-by-step guide. Source: https://leakwatch.net/secrets/mailchimp-api-key --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Mailchimp API Key Messaging · Secret guide # Leaked Mailchimp API Key: what to do in the first hour High severityDetected onlyLast verified October 19, 2026 · 4 min read A Mailchimp API key gives whoever holds it the access of the account user who created it. The key has no scopes: it can read your audiences and subscriber details, export them, create and send campaigns, and change account settings. That makes a leak a data incident (your subscribers’ email addresses) and a reputation risk (a phishing campaign sent from your sender identity). It does not reach your servers. Disable the key first, then audit what it could do. [Check your GitHub account for leaked secrets — free](/) Provider Mailchimp Severity High Impact SaaS account access and billing Checked live by LeakWatch No ## What a Mailchimp API key looks like A Mailchimp key is 32 lowercase hexadecimal characters, a dash, and a data-center suffix such as `us` followed by two digits: ```text …XXXX-usNN Mailchimp API key (masked: 32 hex characters, dash, data-center suffix) ``` The suffix after the dash tells you which Mailchimp server your account lives on, and it is also the first part of the API host name. That suffix is the one distinctive part, but the 32-character body has no prefix, so a bare string found alone is not enough to attribute it with confidence. The variable that holds it is usually `MAILCHIMP_API_KEY`. Do not confuse it with a Mailchimp Transactional (Mandrill) key, which is a different product and has a different format. ## How Mailchimp API keys get leaked - **Hardcoded in a newsletter script.** A sign-up form handler or import job with the key typed in. - **Committed environment files.** `MAILCHIMP_API_KEY` in a `.env` file or a CMS plugin configuration. - **Front-end code.** A signup widget that calls the API from the browser, shipping the key to every visitor. - **Plugin and theme exports.** A website backup, a theme repository or a plugin settings export that includes the integration key. - **Support threads.** A key pasted into a ticket, an issue or a screenshot while asking why a sync fails. ## What to do in the first hour 1. **Find the key in your account.** In the account’s *Extras* area, open the API keys page (see the link below). The list shows each key’s label, creation date and last-used information, which helps spot an unexpected user. 2. **Create a new key** with a label that names the service it will serve, and keep one key per integration. 3. **Deploy the new key** to the application or secret store, and confirm that a request to the API still works. 4. **Disable or delete the exposed key** from the same list. Disabling is reversible, deleting is permanent; for a leaked key, pick whichever you are sure you will not need to reverse. 5. **Audit your audiences.** Check for exports you did not request, subscribers added or removed in bulk, and changes to audience settings or merge fields. 6. **Audit campaigns and automations.** Look for campaigns or automations you did not create, changed sender addresses and reply-to settings, and anything sent or scheduled recently. 7. **Check the account users.** Review the user list and each user’s keys. The key belongs to a user, so the account’s team members and their roles matter. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github). Not sure what else leaked from the same repository? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Mailchimp Mailchimp keys are managed from the API keys page of your Mailchimp account, reached from the account menu under the extras section, after you sign in as the user who created the key or an administrator. Select the exposed key and disable or delete it. Keys belong to individual users, so a key created by someone else will appear under their login. A person has not confirmed the exact menu wording for this guide, and the interface can change, so if what you see differs, look for the page where API keys are created, and follow Mailchimp’s documentation. ## How LeakWatch detects it The rule is called Mailchimp API Key. Because the key body has no prefix, the rule does not match a bare string: it looks for the word `mailchimp` (or `MailchimpSDK.initialize`) in front, followed by a separator such as `=` or `:`, and then 32 lowercase hexadecimal characters, a dash, `us` and two digits. A key that appears without that context, or with a different data-center suffix, is not reported. The severity is **high**. This type is not checked live: LeakWatch does not send any request to Mailchimp with the key it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone email my subscribers with this key? Yes, if the key belongs to a user allowed to create and send campaigns. Check your campaigns and automations for anything you did not create, and contact Mailchimp if mail was sent in your name. Do I need to tell my subscribers? If subscriber data was exported or read by a stranger, you may have notification duties under data-protection law. This is a decision for a qualified adviser, with the audit results in hand. Does the dash and suffix mean the key is safe to share? No. The suffix only names the server. The 32-character body is the secret, and the whole string is needed for the API, so treat all of it as sensitive. ## Related - [SendGrid API Key](/secrets/sendgrid-api-key) - [Mailgun API Key](/secrets/mailgun-api-key) - [Airtable Personal Access Token](/secrets/airtable-personal-access-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Mailchimp. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)