Locking down API keys with IP allowlists and scopes

An API key that can do everything from anywhere is a liability. A few minutes of configuration turns it into a tightly scoped credential that is far less useful to an attacker.

Scope keys to what they do

A key that only sends mail does not need permission to read your message logs or manage domains. Issue separate keys per job, sending, reporting, administration, and grant each the minimum scope.

Pin keys to known IPs

If your mail is sent from a fixed set of servers, add their addresses to the key's allowlist. A leaked key is then worthless from any other network.

Rotate without downtime

Rotation only works if it does not cause an outage. Create the new key, deploy it alongside the old one, confirm traffic has moved, then revoke the old key. Because both are valid during the overlap, there is no gap.

Restrict by domain

A key scoped to one sending domain cannot be used to spoof another tenant's mail even if it leaks. Combine domain restriction with IP allowlisting and scopes for defence in depth.