Skip to content

Recurly API Key

Service Name: Recurly

Service Description: Recurly is a subscription management and billing platform that helps businesses manage recurring billing, invoicing, and payments for subscription-based services.

Service Address: https://recurly.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level through Recurly's security settings.

Secret Access Scope: Grants programmatic access to Recurly's API, allowing management of subscriptions, billing, invoices, accounts, and payment processing.

Secret Revokement URL: https://app.recurly.com/go/developer/api_keys

Secret Example: 1234567890abcdef1234567890abcdef

Suspicious Activity Investigation Instructions:

  • Review Recurly account logs for unusual API calls or activity

  • Check for unexpected subscription changes, account creations, or billing modifications

  • Monitor for unusual transaction patterns or payment processing activities

  • Verify if there are any unauthorized webhooks or integrations configured

  • Examine API usage patterns for abnormal request volumes or access times

Mitigation Instructions:

  • Log in to your Recurly account at https://app.recurly.com

  • Navigate to Settings > API Credentials

  • Identify the compromised API key

  • Click "Revoke" next to the compromised key

  • Generate a new API key if needed

  • Update all legitimate applications with the new API key

  • Review and update security settings, including IP restrictions if available

  • Audit any subscription or billing changes that may have occurred during the compromise period