Skip to content

Lob API Secret

Service Name: Lob

Service Description: Lob is a cloud-based API platform that provides direct mail and address verification services. It allows businesses to automate and streamline their direct mail campaigns, print and mail postcards, letters, checks, and other physical mail items programmatically through their API.

Service Address: https://www.lob.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured in the Lob dashboard under API Keys settings.

Secret Access Scope: Grants programmatic access to Lob's API services including address verification, mail creation, and tracking.

Secret Revokement URL: https://dashboard.lob.com/#/settings/keys

Secret Example: live_pub_1234567890abcdefghijklmnopqrstuv

Suspicious Activity Investigation Instructions:

  • Review the Lob dashboard for unusual API activity or unexpected mail campaigns.
  • Check API logs for unauthorized access or unusual request patterns.
  • Monitor for unexpected charges or usage spikes in your Lob account.
  • Verify if any new webhooks or integrations have been added to your account.
  • Review recent address verification requests for potential data harvesting.

Mitigation Instructions:

  • Log in to your Lob dashboard at https://dashboard.lob.com/

  • Navigate to Settings > API Keys

  • Delete the compromised API key

  • Create a new API key with appropriate permissions
  • Update your applications with the new API key
  • Review and update IP restrictions for your API keys if available
  • Enable webhook notifications for key security events
  • Consider implementing additional authentication mechanisms if available