Mailchimp Marketing API keys grant access to the whole account and are server-only. Call Mailchimp from a server or edge proxy, use OAuth for apps that connect other users accounts, and return only the subscriber fields your UI needs.
Account-wide access. The suffix identifies your data center.
Access granted by another Mailchimp user.
Validate the email, apply double opt-in where required, and forward to Mailchimp with the key server-side.
Revoke a single key without breaking every other tool.
Visitors can export or delete your audience.
Responses include stats, locations, and tags you may not intend to expose.
Store MAILCHIMP_API_KEY in the vault and expose a subscribe or lookup pipeline that returns only status and merge fields.
Yes. The hosted embed posts to Mailchimp without your API key. The key itself must never be in client code.
You should not store Mailchimp credentials in Webflow client code. RealComposer subscribes list members with API key injected server-side. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
FlutterFlow apps hit CORS and credential limits when calling Mailchimp. Same pattern as Stripe FlutterFlow: edge URL bypasses CORS. Use one RealComposer edge URL with OPTIONS handling, client tokens, and vault injection.
You should not store Mailchimp credentials in JavaScript / HTML client code. Block browser extraction of list API keys via edge-only authorization headers. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To cache mailchimp api to stay under rate limits, put a TTL cache on your RealComposer pipeline. Shared edge cache for popular list metadata endpoints. Shared edge cache absorbs repeat traffic before it reaches Mailchimp.
You should not store Mailchimp credentials in React Native client code. Mobile posts to edge; Mailchimp list subscribe runs server-side. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To combine mailchimp audience with hubspot contacts, use one RealComposer pipeline with parallel steps. List membership from Mailchimp and CRM lifecycle stage from HubSpot. Your Frontend / Web app makes one request instead of several sequential upstream calls.
An API key is a unique secret string that identifies the application calling an API and authorizes its access. Providers use keys to authenticate requests, enforce quotas, and bill usage. Anyone holding the key can act as your application, so secret keys must stay on trusted servers.
PII RedactionPII redaction is removing or masking personally identifiable information, such as names, email addresses, phone numbers, and payment details, from data before it is exposed, logged, or shared. In APIs, redaction ensures clients and logs receive only the personal data they truly need.
Payload SlimmingPayload Slimming is the technique of stripping unneeded properties, internal metadata, and verbose JSON fields from API responses at the edge before sending them to the client. This reduces response size by 80% to 95%, cutting mobile bandwidth usage, memory overhead, and JSON parsing time.