If an API key leaks
Generate a replacement key, revoke the leaked one straight away, then put the new key on your server. Your integration fails for the few minutes between revoking and deploying, which is better than leaving the key open. Publishers then check their postback URLs, because a publisher key can edit them.
On this page
Generate the replacement
Publishers: My Profile, then API Keys, then Generate Key. Networks, signed in as the network’s owner (keys and the webhook secret are owner-only): Workspace settings, then API Keys, then Generate Key. Copy the new key: it’s shown once. If a network account is at its key limit, remove the leaked key first and generate after.
Revoke the leaked key
Publishers choose Revoke on its row; networks choose Remove. Match it by the prefix in the list, the first characters of the key. It stops working at once, except that a publisher key may still read the offer list for up to 30 seconds.
Deploy the new key
Replace the key wherever your servers read it, then make one call to confirm it answers 200.
Publishers: check your postbacks
Open Postbacks and check every row points at your own server. Delete any row you didn’t add. If offer blocking is on for your account, also check no offer was blocked that you didn’t block.
Check it worked
A call with the leaked key now answers 401 with
Invalid or expired API key, and only the new key shows in your list.
| Key | Could | Couldn’t |
|---|---|---|
Publisher key, pk_ | Read your offer list, reports, conversions and billing. Add, change or delete your postback rows. Block offers from your offer list and wall, if offer blocking is on for your account. | Create, list or revoke keys. Read or replace your postback secret. Add teammates or reset passwords. |
Network key, ak_ | Read the offers your network can run, at your rates | Anything else |
A changed row could send your conversions to someone else’s server, and your users would go uncredited until you fix it. The key can’t read your secret, so nobody can use it to fake postbacks to you.
- Publisher postback secret: Postbacks, then Rotate secret. The old secret stops working at once, so update your server straight after, or every postback fails your signature check.
- Network webhook secret: Workspace settings, then Revoke beside the secret, then Generate Webhook Secret, and update your server.
Contact support with your account email, the leaked key’s prefix, and when and where it was exposed. Never send the full key.