Providers / Mailgun
Mailgun API keys and credentials
What every Mailgun credential a founder holds does, whether it expires, and what tends to break. Each fact links to Mailgun's own docs.
Our research on Mailgun is still thin. Treat this page as a starting point and check the linked docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| Mailgun account login | Not documented | – |
| Primary account API key (private) | Not documented | Full access only |
| Domain sending key | Not documented | Can be scoped |
| SMTP credentials (per domain) | Not documented | Not documented |
Each credential
Mailgun account login
- Not documented
Dashboard login. Password/2FA policy not confirmed in sources.
Primary account API key (private)
- Not documented
- Full access only
Generated at sign-up; viewable under Account Settings > API Keys. Allows all CRUD operations on any sending domain in the account. Shown only once; if lost, create a new key. No expiry or rotation process is documented on the authentication page.
Domain sending key
- Not documented
- Can be scoped
Only allows sending messages, and is created per domain from the domain's Sending settings. Shown only once.
SMTP credentials (per domain)
- Not documented
Login and password pair for SMTP sending, created with POST /v3/domains/{domain}/credentials (basic auth with the API key) or in the dashboard under Domain settings > SMTP credentials. Password is omitted from responses after creation; update via PUT on the credential path. Password is generated if none supplied. Expiry and rotation policy not documented in sources reviewed.
What usually goes wrong
- The primary API key is account-wide; if it leaks, every sending domain is exposed
- A lost API key cannot be recovered and must be recreated in every application using it
- Free plan limit of 2 API keys can block new integrations until one is removed
Renewals and billing
- Mailgun Basic, Foundation or Scale plan, billed monthly. Basic from $15/mo (10,000 emails); Foundation $35/mo (50,000); Scale $90/mo (100,000). Billed monthly; annual options not listed on the pricing page reviewed. Free plan: 100 emails/day, 2 API keys.
Monthly fee plus overage per 1,000 emails (from $1.80 Basic, $1.30 Foundation, $1.10 Scale). Email validations and dedicated IPs ($59/IP/mo) are billed on top.
What Mailgun's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- API key expiry and rotation policy (an old 2014 blog mentions a 48-hour grace period; not confirmed for current product)
- SMTP credential expiry and rotation policy
- Whether primary keys can be restricted by IP or role (RBAC mentioned in a blog only)
- Whether the Mailgun billing page shows annual options for the current plans
- Exact SMTP credential scope
Rotating or replacing a Mailgun key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
- documentation.mailgun.com/docs/mailgun/api-reference/authentication
- documentation.mailgun.com/docs/mailgun/api-reference/send/mailgun/credentials/post-v3-domains--domain-name--credentials
- www.mailgun.com/pricing/
Related providers
Keep track of every Mailgun key
StackHangar stores your Mailgun keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.