Skip to content

Nexmo API Secret

Service Name: Nexmo (now Vonage API Platform)

Service Description: Nexmo, now part of Vonage, provides communication APIs for SMS, voice, video, and verification services that enable businesses to connect with customers globally through various communication channels.

Service Address: https://www.vonage.com/communications-apis/ (formerly nexmo.com)

Validation Type: API Auth

IP Allow list: IP restrictions can be configured in the Vonage Dashboard for API requests

Secret Access Scope: Grants access to Vonage Communication APIs including SMS, voice calls, messaging, and verification services. The API Secret is used in combination with an API Key for authentication.

Secret Revokement URL: https://dashboard.nexmo.com/settings

Secret Example: abCD1234EfGh5678IjKl

Suspicious Activity Investigation Instructions:

  • Review the Vonage Dashboard for unusual API usage patterns or unexpected charges
  • Check API logs for unauthorized access or unusual destinations for messages/calls
  • Monitor for unexpected spikes in API usage or costs
  • Review IP addresses that have been accessing your API credentials
  • Check for unusual geographic patterns in API usage

Mitigation Instructions:

  • Log in to the Vonage Dashboard at https://dashboard.nexmo.com/
  • Navigate to Settings > API Settings
  • Regenerate your API Secret (note this will invalidate the old secret)
  • Update all applications and services using the API credentials with the new

secret

  • Consider implementing IP restrictions for API access if not already in place
  • Review and update webhook URLs to ensure they point to your secure

endpoints

  • Enable two-factor authentication for your Vonage account
  • Consider using signed requests for additional security where supported