If you notice a login, a send or complaints you cannot explain, alert Sarbacane support right away, then change your password and renew your API keys. These actions cut off access for anyone using your account.
Signs that should alert you:
your usual credentials no longer work;
emails you did not schedule have been sent from your account;
you suddenly receive a lot of complaints from your recipients;
a session you do not recognize appears in the session history (unknown device or location).
Have access to the mailbox linked to your Sarbacane account.
To view the session history and manage the Sarbacane Campaigns API keys: have the Owner or Administrator role.
Write to [email protected] and describe what you noticed: date, suspicious send, error message.
Change your password by following How do you change or reset your password in Sarbacane?
Enable two-factor authentication by following I am a user. How do I enable or disable two-factor authentication?
In the top-right corner of the screen, click your avatar, then click Security in the left-hand menu.
At the top of the page, open the Session history tab.
Use the filters above the list to choose the period and the user, then look for a row whose Device or Location does not match any of your users.
In Sarbacane Campaigns, in the left-hand bar, click the Settings icon (gear), then click API & Webhooks in the submenu.
Above the list of keys in the API tab, click Create to create a new key.
Replace the old key with the new one in each of your connected tools (CRM, website, connectors).
Caution: a deleted key stops working immediately. Make sure all your tools use the new key before you delete the old one.
To the right of the old key, click •••, then delete the key. Repeat for each old key.
Report the fraud to the competent authority in your country.
Note: if you also use Sarbacane Sendkit, its API keys are managed separately in Sarbacane Sendkit. Renew them the same way.
Best practice: restrict access to your account to your IP addresses with How does access restriction by IP work?
The old password and the old API keys no longer work. Logging in now requires the new password and the two-factor authentication code.
First check what you typed (capital letters, extra space). If the error persists, click Forgot password on the login page. If you do not receive the reset email, write to [email protected]: someone may have changed the account's email address.
Someone can use your account without changing the password, or through an API key. Follow all the steps above, including renewing the API keys.
Check that the latest campaigns sent really come from you. If one of them does not, follow the steps above.
Sarbacane does not send this type of alert: this email does not come from us. Do not click any link in it, check the Session history tab to see the actual logins, then forward the email to [email protected].
They are probably using a deleted API key. Create a new key in API & Webhooks and enter it in the tool.
This menu is reserved for the Owner and Administrators. Ask the account owner to carry out these checks.
