Skip to main content
If your API key (MMK_API_KEY) was exposed — pasted into client-side code, shared in a screenshot, or committed to a public repository — reissue it. Reissuing generates a brand-new key and redeploys your service so the new key takes effect, making the leaked key useless.

​
When you need this

Reissue your API key if any of these happened:
  • The key was committed to a public GitHub repo (including through “vibe coding”).
  • It appeared in a screenshot, a support message, or client-side code.
  • You simply suspect someone else has seen it.
Your API key authenticates every request to your deployment, so a leaked key lets someone else call your service. See Authentication for what the key is and where it’s used.
Reissuing immediately invalidates your current key — every existing connection that uses it breaks at once. Your Make.com connection, the CLI, and any MCP client all start failing with 401 Unauthorized until you update each one with the new key. Your service also redeploys (~1–2 minutes), during which requests may briefly fail. Only reissue when you’re ready to update every connection right afterward. Your service URL, license, and data are all kept.

​
Reissue your API key

1

Sign in to Google Cloud

Sign in at make.magicmealkits.com/google-connection.
2

Open the App Status page

Go to make.magicmealkits.com/app-status.
3

Reissue the key

In the Connection & Access card, under API Key, click Reissue API key and confirm. Your service redeploys with a freshly generated key.
4

Copy your new key

When the new key appears, copy it. You can also view it any time later with the eye (👁) button next to the API Key field on this page.

​
After reissuing — update your clients

The old key stops working right away, so update everything that uses it:
  • Make.com connection — this lives in your Make account, not on make.magicmealkits.com. Open the Connections page for your Make zone — https://<zone>.make.com/<team-id>/connections — where <zone> is the region in your Make address bar (e.g. us1, us2, eu1, eu2). Open the Magic Meal Kits connection and replace the API key with the new one.
  • CLI — set the new key in your CLI config (the stored api-key value).
  • MCP clients — update any MCP client configured with the key.
Until each connection has the new key, its requests will fail with 401.

​
Also remove the exposed key

Reissuing makes the leaked key useless, but still clean up where it leaked:
  • Delete the key from your code, screenshots, and any public location.
  • If it was committed to git, removing it from the current files does not erase it from the commit history. Make the repository private, or scrub the key from the history.

​
Still stuck?

If the reissue doesn’t complete or your clients still can’t connect after updating the key, contact support with your account email and a short description of what you’re seeing.