About API Keys

In this article, we'll cover what an API is and how to generate an API key to grant access to your Mailchimp account. We’ll also cover where to go for support with questions about the Mailchimp Marketing API.

What is an API?

API stands for application programming interface. Think of an API as a way for different apps to talk to one another. You send and receive data between apps using API requests and responses. An API key is a unique series of characters that’s included in a request to verify that the requesting system is allowed to communicate with the receiving system.

Generate an API key

You’ll often need to generate an API key when you set up an integration with your Mailchimp account. Users with Manager permissions can generate their own API keys. Users with Admin permissions can also see the API keys other account users have generated.

To generate an API key, follow these steps.

1. Click your profile icon and choose Profile.
2. Click the Extras drop-down then choose API keys.
3. In the Your API Keys section, click Create A Key.
4. Name your key. Be descriptive, so you know what app uses that key. Keep in mind that you’ll see only this name and the first 4 key digits on your list of API keys.
5. Click Generate Key.
6. Once we generate your key, click Copy Key to Clipboard. Save your key someplace secure–you won’t be able to see or copy it again. If you lose this key, you’ll need to generate a new key and update any integration that uses it.
7. Click Done.

Revoke an API key

If an API key has been compromised, or you no longer use the integration that was accessing your account through it, you can revoke that API key. Once you’ve revoked an API key, it can’t be reactivated. You’ll need to generate a new key and update any integrations that use the original key.

To revoke an API key, follow these steps.

1. Click your profile icon and choose Profile.
2. Click the Extras drop-down then choose API keys.
3. Find the API key you want to revoke and click Revoke.
4. In the pop-up modal, type REVOKE then click Revoke to confirm your action.

API key security

API keys grant full access to your Mailchimp account. You should protect them the same way you would protect your password. Keep these common scenarios in mind when working with API keys.

• Give each integration its own API key. Assign descriptive names to each key so you know which key goes with which app. If a specific API key is compromised, you can revoke that key without disabling access to your other integrations.
• Be careful not to expose the key to the public (such as in screenshots, videos, or help documents). Remember that blurring your data isn't always enough. It's best to remove the data completely.
• Because of the potential security risks that come with exposing account API keys, Mailchimp doesn’t support client-side implementation of our API using CORS requests or including API keys in mobile apps.
• If you need to share access to your account, generate a new key and name it so you’ll know which key to revoke, if needed. Never email an API key. This could allow access to your Mailchimp account if hackers were to compromise your email account.
• If you revoke a user's access to your Mailchimp account, we’ll remove any API keys that user generated from your account.
• The role of the user who generated the API key determines access to each endpoint. To learn more about user level permissions, visit Manage User Levels in Your Account.

API support

Our Mailchimp Support team isn't trained for in-depth API troubleshooting. If you need a developer to help you configure something using the API, check out our great Experts Directory. This lists third-party Mailchimp experts who can be hired to help out.

If you're a developer who wants to build your own integration with Mailchimp, check out our API documentation.