How to rotate your Mailgun API key

Updated October 2026

Make a new Mailgun key with the same role as the old one, put it in your app, then delete the old key. A new key does not end the old one, so you can switch with no gap.

The manual steps

1. Open API security in your Mailgun settings.
2. Add a new key with the same role and kind as the one your app uses now.
3. Copy it right away. Mailgun shows the full key once.
4. Update every place the old key lives. Your host's environment variables and any script that sends mail.
5. Delete the old key once mail goes out on the new one.

What breaks if you miss a place

Mail stops going out from anything that still holds the old key, the moment you delete it. That is easy to miss, because a failed email often fails quietly.

How to check the old key is actually dead

Make a read call with the old key, like listing your keys with GET /v1/keys. A deleted key gets a 401. It sends no mail, so it costs nothing.

You can do it by API

Mailgun's API makes a key with POST /v1/keys and deletes one with DELETE /v1/keys/{key_id}. EU accounts use api.eu.mailgun.net instead of api.mailgun.net.

Or let Key Robot do it

Key Robot does this for you today, with an Admin-role key you make once. It makes the new key with the same role, kind and domain, puts it in your app on Netlify, Vercel, Render, Railway or Cloudflare Workers, checks your app still works, and then deletes the old key. It deletes only keys it made.

In our live test on October 26, 2026, one change took 16 seconds, and Mailgun refused the old key 2.1 seconds later. No email was sent.

See how to rotate your Resend key or your SendGrid key for the other email services, or the rotate hub for every service.