Resend API Key Leaked: Rotation and Damage Control
Updated 2026-10-17
A leaked email API key can let someone send mail as your verified domain — phishing your users with your reputation.
Contain
Revoke the key in the Resend dashboard, create a new key with the narrowest permission (sending-only, single domain if available), and set it only in server environment variables.
Send from the server
Expose a route that sends specific, templated emails (e.g. 'welcome', 'reset') rather than a generic 'send any email' endpoint.
Checklist
- Old key revoked
- New key sending-only
- No generic send endpoint
- SPF/DKIM/DMARC configured
- Recent sends reviewed
Copy-paste fix prompt
Remove the Resend key from client code, create a server route that only sends my predefined templates to the signed-in user's own email, and read RESEND_API_KEY from a server-only env var.FAQ
Does DMARC stop abuse of a leaked key?
No. Mail sent through your provider with your key passes authentication. Revoke the key.
Is the RESEND_API_KEY name in my bundle a leak?
The name alone is not, but it signals server config is bundled to the client. Check for values too.
Check your deployed app in ~25 seconds
Free passive scan: leaked keys, Supabase exposure, public config files and headers.
Run a free scan