Account security
Harden the account that can mail your entire customer base: strong password, two-factor authentication, API token hygiene, and an access review.
On this page›
What you are protecting#
This page is about protecting one specific thing: the account that can send email to every contact you have ever collected. By the end you will have a password worth having, a second factor on the login, an API token you treat as a secret, and a short habit for reviewing who can get in.
Why this account is worth attacking#
Be clear about the stakes, because they are not the usual ones.
Someone who gets into this account does not steal a document. They get your subscriber list, your reply-to address, your authenticated sending domain, and permission to mail all of it. A message sent from your domain, past your SPF and DKIM records, into inboxes that have already learned to trust you, is close to the most credible phishing an attacker can send. Your customers open it because it is genuinely from you.
The damage is not limited to the message. Spam complaints attach to your sending domain, and a domain reputation takes weeks to rebuild. The list is exfiltrated whether or not anything is sent. And the recovery involves telling every contact what happened.
That is why this account deserves better protection than an average login.
Use a strong, unique password#
Unique matters more than complicated. Most account takeovers are not someone guessing your password, they are someone replaying a password you used on a site that was breached years ago.
- Use a password manager and let it generate the password. You are never going to type it.
- Never reuse the password from any other service, especially not from the inbox this account is registered to.
- Change it immediately if you have any reason to think it was exposed, including a shared password that a departing colleague knew.
If you are choosing something you have to remember, longer beats cleverer. Four or five unrelated words are stronger than a short word with symbols substituted into it.
Turn on two-factor authentication#
A password can be phished, reused, or read from a breach dump. A second factor means a stolen password on its own is not enough to send email as you.
Two-factor authentication uses an authenticator app on your phone, the kind that shows a six digit code that changes every thirty seconds. You will find it in the account area under 2FA. Scan the code it shows, enter the number your app generates to confirm the pairing, and it is active from your next sign in.
Do this before you import a real list, not after.
Then close the other door. The inbox your account is registered to can reset the password, so it can take over the account. Two-factor authentication here is worth very little if the recovery mailbox has none. Protect both.
Store the recovery codes off the laptop
If you are given backup or recovery codes, put them somewhere you can reach without the device that holds your second factor. In a password manager, or printed and filed. People lose phones, and a lost second factor with no recovery code is a support ticket at the worst possible time.
An authenticator app is the right choice here, and it is what the account uses. Codes sent by text are weaker, because phone numbers can be ported away from you.
Treat the API token as a password#
The API base at https://mail.igsendmail.com/api/v1 is authenticated with an api_token you get from the account area. That token is not a convenience credential. It carries the account's authority, and it travels as a query parameter, which means it can end up in places plain passwords do not: server access logs, proxy logs, browser history, a screenshot in a chat thread, a URL pasted into a support ticket.
Rules that keep it out of trouble:
- Never commit it. Not to a private repository either. Use an environment variable or a secrets manager and read it at runtime.
- Never put it in client-side code. Anything that reaches a browser or a mobile app is public, whatever it says in the source file.
- Never paste it into a chat, ticket, or document. Support will not ask you for it.
- Do not share one token across unrelated integrations. Separate systems that need to be revoked separately should not depend on the same secret.
If the token is exposed
Assume exposure means compromise. A token in a public repository is scraped in minutes, not days.
Replace the token
Open API token in the account area and get a new one. The old value stops being useful only once it has been replaced, so this is the step that actually stops the bleeding. If you cannot see how to replace it, contact support immediately rather than waiting.
Update every integration that used it
Work through your integrations and swap in the new value. Anything you miss stops working, which is inconvenient but visible, and much better than leaving the old token live.
Remove the exposed copy at the source
Delete the commit, rotate the log, close the ticket. Do this after replacing the token, not instead of it. Removing a secret from a repository does not remove it from anyone's clone or from the caches that already scraped it.
Check what was done with it
Review recent campaigns, Senders, Lists and Automations for anything you did not create, and look for exports you did not run.
Review who has access#
Access accumulates quietly. Someone needed the login for a launch two years ago and nobody took it back.
Once a quarter, and immediately whenever someone leaves, check:
- Who can sign in to the account, and whether each of them still needs to.
- Who knows the password, if it is shared at all. A shared password cannot be revoked from one person, only changed for everyone.
- Which integrations hold an API token, and whether each is still in use.
- Whether the recovery email address is still an inbox your organization controls, not the personal address of a former contractor.
When someone with access leaves, change the password and replace the API token the same day. Removing a person's calendar invite is not the same as removing their access.
Treat unexpected sending as an incident
A campaign you did not create, a sender you did not add, or a contact export you cannot account for means the account is compromised right now. Change the password, replace the API token, and contact support. Do not wait to see whether it happens again.
Last updated September 10, 2026