Skip to content

EasyPost API Key

Service Name: EasyPost

Service Description: EasyPost is a shipping API that helps businesses with shipping logistics, including label creation, tracking, address verification, and rate calculation across multiple carriers.

Service Address: https://www.easypost.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured in the EasyPost dashboard for API access

Secret Access Scope: Grants full access to the EasyPost API, allowing users to create shipments, purchase labels, track packages, verify addresses, and access all account features.

Secret Revokement URL: https://www.easypost.com/account/api-keys

Secret Example: EZAK_TEST_KS5mEOKqgkdgQs0Wq7kTOw

Suspicious Activity Investigation Instructions:

  • Review the EasyPost dashboard for unusual shipping activity or label purchases
  • Check for unexpected API calls in the EasyPost event logs
  • Monitor for shipments to unfamiliar addresses or unusual destinations
  • Look for spikes in API usage or shipping volume that deviate from normal patterns
  • Verify if there are any new webhooks or integrations that were recently added

Mitigation Instructions:

  • Log in to your EasyPost account at https://www.easypost.com/

  • Navigate to Account Settings > API Keys

  • Revoke the compromised API key by clicking "Revoke"

  • Generate a new API key to replace the compromised one
  • Update the API key in all legitimate applications and services
  • Review and update IP restrictions for API access if available
  • Enable additional security features like two-factor authentication for your

EasyPost account

  • Monitor account activity for several days to ensure no unauthorized access

continues