Skip to main content

​
Best Practices

Handle your API keys securely. Don’t share your API key with others or expose it in the browser or other client-side code. Here are some general guidelines:
  • Store API keys in environment variables.
  • Never commit API keys to version control.
  • Never hard-code API keys in your code or share them publicly.
  • Rotate API keys regularly. If an API key hasn’t been used in the last 30 days, consider deleting it to keep your account secure.
You can view an API key only once after you create it.
If a key has already been exposed or used without your authorization, see how to handle a leaked API key.

​
Key Rotation

Resend API keys don’t expire automatically. Keys remain valid until you manually delete them. Resend includes no built-in expiration date or automatic rotation mechanism, but it’s a good security practice to rotate keys regularly. To rotate an API key:
  1. Create a new key in the API keys Dashboard page or via the API with the same permission level and domain scope as the key you’re replacing.
  2. Update your services to use the new key. Deploy the change to all environments that reference the old key.
  3. Verify the new key is working by filtering by API key on the Logs Dashboard page and checking for recent requests.
  4. Delete the old key once you’ve confirmed the new key is active across all services.
Don’t delete the old key before the new key is deployed everywhere. Both keys will work simultaneously, so ensure your new key is working before deleting your old key so you don’t experience downtime during the transition. You can programmatically create, list, and delete API keys to rotate keys.
Rotate keys at least every 90 days, or immediately if you suspect a key has been compromised. Resend flags keys unused for 30 or more days in the Dashboard to help you identify keys to review or delete. If you already know a key has leaked, delete it now rather than rotating it on a schedule. The steps to contain the incident are in how to handle a leaked API key.