> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailofly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Leaked API Keys

> What to do if an API key is accidentally exposed.

If an API key is accidentally exposed on GitHub or a public URL, act immediately to prevent unauthorized email sending.

***

## Remediation Steps

1. **Revoke the Compromised Key**:
   * Open the [API Keys dashboard](https://www.mailofly.com/user/api-keys).
   * Find the leaked key and immediately click **Revoke**.
2. **Generate a Replacement Key**:
   * Click **Create API Key**.
   * Update your production environment variables (Vercel, AWS, Fly.io, Railway, Heroku).
3. **Audit Activity Logs**:
   * Review **Activity Logs** in the dashboard to check if any unauthorized messages were dispatched while the key was exposed.
   * If spam was dispatched, check your **Suppression List** and contact Mailofly support.


## Related topics

- [API Key Security](/guides/api-keys/api-key-security.md)
- [Manage API Keys](/guides/api-keys/manage-api-keys.md)
- [Create API key](/getting-started/api-keys.md)
- [AI onboarding](/getting-started/ai-onboarding.md)
- [Idempotency Keys](/sending/idempotency-keys.md)