# Leaked Postmark Server Token? Regenerate It Now > Postmark server token exposed on GitHub? Regenerate it, check the activity feed for abuse and review sender signatures. Step-by-step guide. Source: https://leakwatch.net/secrets/postmark-server-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Postmark Server Token Messaging · Secret guide # Leaked Postmark Server Token: what to do in the first hour High severityDetected onlyLast verified October 19, 2026 · 4 min read A Postmark server token lets whoever holds it send email through one Postmark server, as any sender signature or domain that server is allowed to use. That is the main danger: messages that really come from your domain, which makes phishing or spam sent with a stolen token look genuine and damages your sending reputation. Depending on the endpoints used, the token can also read the message history of that server. Regenerate the token first, then check what was sent. [Check your GitHub account for leaked secrets — free](/) Provider Postmark Severity High Impact SaaS account access and billing Checked live by LeakWatch No ## What a Postmark server token looks like A Postmark server token is a UUID: 36 characters made of lowercase letters and digits in groups of 8, 4, 4, 4 and 12, separated by dashes: ```text XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX Postmark server token (masked UUID) ``` That format is the same as thousands of harmless identifiers, so the string alone says nothing. What identifies it is context: the variable name (`POSTMARK_SERVER_TOKEN`, `POSTMARK_API_TOKEN`), a call to `api.postmarkapp.com`, or the `X-Postmark-Server-Token` header. Postmark also has an *account* token, used for account-level operations such as managing servers and domains, which is separate from the server token and more powerful. If both appear in the leaked file, handle both. ## How Postmark server tokens get leaked - **Mail configuration in code.** An SMTP or API setup for password resets and receipts committed with the token inside. - **Committed environment files.** `POSTMARK_SERVER_TOKEN` in a `.env` file, a Docker compose file or a framework mail config. - **Framework defaults.** Mail settings in a Rails, Laravel or Django project where the token also serves as the SMTP username and password, so it appears twice. - **Continuous integration.** A token printed by a debug step or stored in a public pipeline definition. - **Support threads and screenshots.** A request pasted with the header, or a configuration page captured with the token visible. ## What to do in the first hour 1. **Open the server in Postmark.** In the Postmark account, choose the server that the leaked token belongs to (see the link below) and open its API tokens tab. If you run several servers, match the token by its last characters. 2. **Regenerate the token.** The tab offers a way to generate a new server token, which replaces the old one. Do this before cleaning anything else. 3. **Deploy the new token** to the application or secret store, then send a test message through the server. 4. **Check the activity.** Use the message and activity views of the server for the period since the exposure. Look for messages you did not send, unusual recipients, large volume or odd subject lines. Check the bounce and spam complaint figures, which jump when someone abuses a sender. 5. **Review sender signatures and domains.** See which addresses and domains the server can send from. Remove any you do not recognize, and keep only those in use. 6. **Check other tokens.** If an account token was in the same file, regenerate it too, and review who has access to the account. 7. **Clean up the code** and look for other secrets next to the token. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github). Not sure what else leaked from the same repository? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Postmark Postmark server tokens are managed from the API tokens tab of each server in your Postmark account, after you sign in with a user allowed to manage that server. Open the server, go to the tab that lists its tokens, and regenerate the exposed one. A regenerated token replaces the old value, so every system that used the old one must be updated. A person has not confirmed the exact menu wording for this guide, and the interface can change, so if the page differs from this description, look for the section where server tokens are shown, and follow Postmark’s documentation. ## How LeakWatch detects it The rule is called Postmark Server Token. Because a UUID is common, the rule does not match a bare one: it looks for the word `postmark`, followed within about 40 characters by a UUID-shaped value, in any letter case. A UUID that is not close to the word `postmark`, or one that is shorter or has a different grouping, is not reported. That keeps false alerts down, but a token pasted without the word nearby can be missed. The severity is **high**. This type is not checked live: LeakWatch does not send any request to Postmark with the token it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone send email from my domain with this token? Yes, from any sender signature or domain that the server is allowed to use. That is why you should review the signatures and the activity of the server, not only replace the token. What is the difference between a server token and an account token? A server token acts on one server: sending and reading its messages. An account token acts on the account: managing servers, domains and signatures. The second is more sensitive, so check whether it leaked too. Will regenerating the token break my email sending? Until you deploy the new value, yes. Prepare the deployment first, then regenerate. If the token is clearly being abused, regenerate it at once and accept a short interruption. ## Related - [SendGrid API Key](/secrets/sendgrid-api-key) - [Mailgun API Key](/secrets/mailgun-api-key) - [Mailchimp API Key](/secrets/mailchimp-api-key) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Postmark. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)