A Postman API key lets whoever holds it call the Postman API as you. That reaches your collections, environments, workspaces and mock servers, and everything stored in them. Environments are the risky part: they often hold staging passwords and third-party tokens typed in by hand. Postman keys belong to a person, so the damage follows that person’s access, not one project. Replace the key first, then look at what it could reach.
Check your GitHub account for leaked secrets — free
- Provider
- Postman
- Severity
- Critical
- Impact
- Source code and build access
- Checked live by LeakWatch
- No
What a Postman API Token looks like
Postman API keys start with a fixed prefix, PMAK-, followed by two long hexadecimal segments separated by a dash:
PMAK-…XXXX Postman API key (masked)
The prefix makes a hit specific, because little else in ordinary code starts with PMAK-. Postman also issues other credentials that look different, such as access tokens from its sign-in flow. If the leaked string does not start with PMAK-, it is probably not a Postman API key, so check which vendor issued it before you start.
How Postman API Tokens get leaked
- Exported collections. Exports can include environment files, and those files hold credentials that were typed in directly. A committed export can carry both the Postman key and everything it unlocks.
- Scripts and CI jobs. The key is passed to
newmanor to a direct API call from a pipeline file, and the file is committed with the literal value instead of a variable. - Screenshots and tickets. A picture of the Postman header or a request pasted into a public issue.
- Tutorials copied verbatim. A key pasted into a snippet to try an endpoint, then published together with the output.
- Local config. Tools that save the key in a file inside a repository or a synced folder.
What to do in the first hour
- Create a replacement key first. Open the API keys page in your Postman account settings and generate a new key. Name it after the place it will be used, such as one CI job, so the next revocation is easier.
- Update the systems that need it. Put the new key into your CI secret store or local environment, then run a collection to confirm it works.
- Delete the exposed key from the same page. Calls that use the old value fail from then on, so do not keep it around “just in case”.
- Review workspace activity. Check the activity or history views of the workspaces this key could reach, for the period since the exposure. Look for collections you did not change, new monitors, new mock servers and edited environments. What is logged depends on your plan, so note what you can and cannot see.
- Check the environments. Treat every secret stored as an environment variable as exposed too, and rotate those values at their own providers.
- Check monitors and mock servers. Scheduled monitors and mock servers run from your account. Remove any you do not recognize.
- Clean the repository. Remove the value from the file and rewrite history if you need to. See I accidentally pushed an API key to GitHub and deep scan your whole git history.
Not sure what else leaked? Run a free scan.
Revoke it at Postman
Postman API keys belong to your user account. Open the API keys page in your account settings, find the key by its name, and delete it. If your team relies on a key tied to a service account or a shared integration, the owner of that account has to create the replacement. Deleting the key ends its access, but it does not undo anything the key already did, so the activity review above still matters.
How LeakWatch detects it
The rule is called “Postman API Token”. It looks for the prefix PMAK-, then 24 hexadecimal characters, a dash, and 34 more hexadecimal characters, matched without regard to letter case. The match has to end at a quote, whitespace, a semicolon, a backtick or a line break, so a key glued to other characters is not reported. The severity is critical. This type is not checked live: LeakWatch does not send any request to Postman with the key it found.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Can someone read my collections with this key?
Yes. The key acts as you in every workspace you can reach, so it can read the collections and environments there. Assume anything stored in those workspaces was seen, and rotate the secrets saved in environments.
I deleted the file. Is that enough?
No. Deleting the file leaves the value in the repository history and in every clone or fork that already pulled it. Revoke the key first, then clean the history.
Does a key from a team admin behave differently?
Keys are tied to a user, and what they can reach depends on that user’s roles. A key from an admin can reach more than a key from a viewer. Revoke any exposed key, whatever its owner’s role.