# Mailgun secret API key rejected

**URL:** https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852
**Category:** Support
**Created:** [Abril 30, 2017, 10:27am UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852 "2017-04-30T10:27:45Z")
**Posts on this page:** 19
**Page:** 1

<div class="post-metadata">

### Author: ![lunikon](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lunikon](https://meta.discourse.org/u/lunikon)
#### Post date: [Abril 30, 2017, 10:27am UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/1 "2017-04-30T10:27:45Z")

</div>

Hi everyone,

I tried to set up Mailgun bounce handling today and therefore wanted to configure the secret Mailgun API key. But I can’t save the key and only get this error message:

> Value doesn’t match the required format.

Have they changed their format maybe? My key is “key-” followed by 32 lower-case alpha-numeric characters.

---

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [Abril 30, 2017, 10:37am UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/2 "2017-04-30T10:37:02Z")

</div>

> [@lunikon](#):
>
> My key is “key-” followed by 32 lower-case alpha-numeric characters.

The regex looks fine to me:

> <https://github.com/discourse/discourse/blob/a26483bfd6a2c3333e3a84c91e143821aab8632e/config/site_settings.yml#L681-L683>

And I can’t repro the issue locally using a random key like: `key-a64b3021781d9467b6c7e9da7741fed0`

---

<div class="post-metadata">

### Author: ![lunikon](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lunikon](https://meta.discourse.org/u/lunikon)
#### Post date: [Abril 30, 2017, 10:51am UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/3 "2017-04-30T10:51:10Z")

</div>

The RegEx matches hex values, but my Mailgun key looks more like

```
^key-[a-z0-9]{32}$

```

Haven’t tested this regex, just off the top of my head 😉

---

<div class="post-metadata">

### Author: ![lunikon](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lunikon](https://meta.discourse.org/u/lunikon)
#### Post date: [Abril 30, 2017, 10:56am UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/4 "2017-04-30T10:56:33Z")

</div>

Correction: Just saw that my API key even includes dashes (-).

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [Abril 30, 2017, 4:41pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/5 "2017-04-30T16:41:14Z")

</div>

Strange. I just opened a ticket on Mailgun asking if the API key format has changed.

Edit: And I heard back from them. It’s still the same. @lunikon, my best guess is that you’re using an SMTP password rather than an API key. You can look at my [install FAQ](https://www.literatecomputing.com/product/discourse-install/#API) for how to find the API key.

---

<div class="post-metadata">

### Author: ![lunikon](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lunikon](https://meta.discourse.org/u/lunikon)
#### Post date: [Maio 2, 2017, 9:30am UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/6 "2017-05-02T09:30:01Z")

</div>

I am definitely using an API key, from the exact location described in your install FAQ. I guess I’ll have to contact Mailgun myself and figure out what went wrong there. Maybe there was a bug on their side when my set of keys was generated.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [Maio 26, 2017, 5:24pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/9 "2017-05-26T17:24:22Z")

</div>

I am unable to repro with an actual key from mailgun, feel free to PM me your key if you want me to test it.

---

<div class="post-metadata">

### Author: ![mshappe](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mshappe/32/104819_2.png) [@mshappe](https://meta.discourse.org/u/mshappe)
#### Post date: [Agosto 16, 2017, 8:14pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/10 "2017-08-16T20:14:33Z")

</div>

I am also seeing this issue on a new install.

ETA: 1.9.0.beta6

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [Agosto 16, 2017, 9:54pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/11 "2017-08-16T21:54:18Z")

</div>

And you’re sure that you’re using an API key and not a password?

---

<div class="post-metadata">

### Author: ![mshappe](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mshappe/32/104819_2.png) [@mshappe](https://meta.discourse.org/u/mshappe)
#### Post date: [Agosto 16, 2017, 10:06pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/12 "2017-08-16T22:06:32Z")

</div>

Very very quite certain 🙂

---

<div class="post-metadata">

### Author: ![Uninen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/uninen/32/66432_2.png) [@Uninen](https://meta.discourse.org/u/Uninen)
#### Post date: [Fevereiro 20, 2018, 6:33am UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/13 "2018-02-20T06:33:27Z")

</div>

I’m having the same problem with v2.0.0.beta3. My Mailgun API key also has dashes in it, I assume the regex just doesn’t match. (And yes, I’m definitely using the correct secret key, not a password.)

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [Fevereiro 20, 2018, 12:27pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/14 "2018-02-20T12:27:06Z")

</div>

Nene generate another key?

---

<div class="post-metadata">

### Author: ![lunikon](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lunikon](https://meta.discourse.org/u/lunikon)
#### Post date: [Junho 2, 2018, 5:46am UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/15 "2018-06-02T05:46:55Z")

</div>

So apparently this problem does exist for several people over a longer time-span. Wouldn’t it be easier to just make the regex in Discourse less restrictive? The worst that could happen is that someone enters a wrong key, resulting in an error message somewhere. But that could already happen today (with an expired key for example).

---

<div class="post-metadata">

### Author: ![Cameron\_D](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cameron_d/32/97535_2.png) [@Cameron\_D](https://meta.discourse.org/u/Cameron_D)
#### Post date: [Junho 2, 2018, 6:15am UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/16 "2018-06-02T06:15:18Z")

</div>

I had this problem.  
I think older API keys are 32 alpha-numeric, and newer ones are 32 hex characters, and the regex only allows hex. I don’t use the API anywhere else, so I just re-generated my API key so I had a new hex-only one.

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [Junho 2, 2018, 12:49pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/17 "2018-06-02T12:49:23Z")

</div>

I’ve noticed that the keys I’ve seen lately no longer start with “key=”

---

<div class="post-metadata">

### Author: ![oxxi](https://avatars.discourse-cdn.com/v4/letter/o/53a042/32.png) [@oxxi](https://meta.discourse.org/u/oxxi)
#### Post date: [Julho 31, 2018, 10:06pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/18 "2018-07-31T22:06:19Z")

</div>

My current mailgun secret API key gives the error `mailgun_api_key: Value doesn't match the required format.` I’m on v2.1.0.beta3 +64. Anything I can do to make it accept my API key?

---

<div class="post-metadata">

### Author: ![schleifer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/schleifer/32/86416_2.png) [@schleifer](https://meta.discourse.org/u/schleifer)
#### Post date: [Agosto 3, 2018, 5:42pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/19 "2018-08-03T17:42:26Z")

</div>

What is the format of your key? Does it start with `key-`? Are all of the trailing characters in `1234567890abcdef`?

---

<div class="post-metadata">

### Author: ![oxxi](https://avatars.discourse-cdn.com/v4/letter/o/53a042/32.png) [@oxxi](https://meta.discourse.org/u/oxxi)
#### Post date: [Agosto 3, 2018, 9:14pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/20 "2018-08-03T21:14:06Z")

</div>

Hi, it’s been fixed. Forgot to update this thread. Here’s the link:

> [@Current Mailgun API key does not work](https://meta.discourse.org/t/current-mailgun-api-key-does-not-work/93661):
>
> It appears that Discourse has hard-coded a regex check for the Mailgun API key. Mailgun’s API keys have undergone a format change to prevent spammers from scrapping publicly accessible repositories for Mailgun API keys. The regex check would need to be addressed to allow API keys that do not match the old naming convention or remove the restriction on the discourse instance locally.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [Agosto 3, 2018, 9:49pm UTC](https://meta.discourse.org/t/mailgun-secret-api-key-rejected/61852/21 "2018-08-03T21:49:15Z")

</div>


