Generate an API key

You’ll often need to generate an API key when you set up an integration with your Mailchimp account. Users with Manager permissions can generate their own API keys. Users with Admin permissions can also see the API keys other account users have generated.

1. Navigate to the API Keys section of your account.
2. Click Create New Key.
3. Name your key. Be descriptive, so you know what app uses that key. Keep in mind that you’ll see only this name and the first 4 key digits on your list of API keys.
4. Click Generate Key.
5. Once we generate your key, click Copy Key to Clipboard. Save your key someplace secure–you won’t be able to see or copy it again. If you lose this key, you’ll need to generate a new key and update any integration that uses it.
6. Click Done.

Revoke an API key

If an API key has been compromised, or you no longer use the integration that was accessing your account through it, you can revoke that API key. Once you’ve revoked an API key, it can’t be reactivated. You’ll need to generate a new key and update any integrations that use the original key.

To revoke an API key, follow these steps.

1. Navigate to the API Keys section of your account.
2. Find the API key you want to revoke and click Revoke.
3. In the pop-up modal, enter REVOKE then click Revoke to confirm your action.

API key security

API keys grant full access to your Mailchimp account. You should protect them the same way you would protect your password. Keep these common scenarios in mind when working with API keys.

• Give each integration its own API key. Assign descriptive names to each key so you know which key goes with which app. If a specific API key is compromised, you can revoke that key without disabling access to your other integrations.
• Be careful not to expose the key to the public (such as in screenshots, videos, or help documents). Remember that blurring your data isn't always enough. It's best to remove the data completely.
• Because of the potential security risks that come with exposing account API keys, Mailchimp doesn’t support client-side implementation of our API using CORS requests or including API keys in mobile apps.
• If you need to share access to your account, generate a new key and name it so you’ll know which key to revoke, if needed. Never email an API key. This could allow access to your Mailchimp account if hackers were to compromise your email account.
• If you revoke a user's access to your Mailchimp account, we’ll remove any API keys that user generated from your account.
• The role of the user who generated the API key determines access to each endpoint. To learn more about user level permissions, visit Manage User Levels in Your Acco