ListFunnel connects to about fifty newsletter and email platforms. For nineteen of them we use OAuth. For most of the rest you paste an API key. The split is not our choice. It is what each provider offers. This post explains why we prefer OAuth, what it protects you from, and where it does not exist.
A key is a master password
An API key from most email platforms can do anything your account can do. Read subscribers, yes. Also send campaigns, delete lists, change your sending domain, export everything. The key does not know who is holding it. If it leaks, whoever has it has your account until you notice and rotate it.
Some providers let you scope keys. Klaviyo private keys can be read-only. SendGrid keys can be restricted to a few endpoints. When a provider offers this we tell you which boxes to tick on the key page. Most providers do not offer it. The key is all or nothing.
OAuth is a permission slip
With OAuth you never hand us a key. You log in at your provider, the provider shows you a list of what ListFunnel wants, and you say yes or no to that list. The provider then gives us a token that can do only what was on the list. For ListFunnel that list is short: read your lists, read the subscribers on them. A token that can only read cannot send a campaign from your account. It cannot delete anything. It cannot change your settings.
Three things a token gives you that a key does not
- Scope. The token does only what the consent screen said. A leaked read-only token is bad. A leaked master key is a disaster.
- Revocation. Every OAuth provider has a connected-apps page. Remove ListFunnel there and the token dies at once, whether or not you ever log in to ListFunnel again. You do not have to trust our Disconnect button.
- Expiry. Most tokens die on their own within hours or days. We refresh them in the background while the connection is live. Once you revoke, refresh fails, and the token is gone for good. A key lives until someone rotates it.
Where OAuth exists
Mailchimp, HubSpot, Klaviyo, Kit, Constant Contact, AWeber, Campaign Monitor, GetResponse, Drip, Zoho Campaigns, Keap, CleverReach, Resend, Shopify, and the enterprise trio of Pardot, Eloqua and Marketing Cloud all let outside apps register for OAuth. Connect is one click for these. Some, like Constant Contact and Kit, review apps before other accounts can install them. Shopify requires a separate approval before an app may read customer email at all.
Where OAuth is gated
Intercom and HighLevel have OAuth, but only for apps they have reviewed, and review takes days. Until that clears, a key is the path. beehiiv, Omnisend and Flodesk grant OAuth to partners by request. Brevo has OAuth but keeps it private. MailerLite has it but does not document it. For all of these we ship a key connector today and switch to one click the day the provider says yes. The connectors page shows which you are getting.
Where only keys exist
ActiveCampaign, Ghost, Braze, Iterable, Customer.io, SendGrid, Mailjet, Moosend, Dotdigital, Benchmark, Marketo, Ortto, Emma, iContact, SendPulse, EmailOctopus, Buttondown, Systeme.io, Sailthru, Sendlane and Bento offer no OAuth to outside apps at all. There is nothing to click through. You make a key, you paste it.
Where nothing exists
Substack, Sendy, Loops, Mailmodo and Acoustic Campaign have no way for an outside app to pull a subscriber list. For these you export a CSV and upload it. Substack has a guided path in ListFunnel that takes about ten minutes.
How we treat a key when you must give one
- We encrypt it before it touches our database, the same as a token.
- We use it only to list audiences and page through subscribers. Nothing else, ever.
- Disconnect deletes it. We do not keep a copy.
- If the provider lets you scope the key, the connect screen says exactly which read permissions to grant and nothing more.
- Rotate the key at your provider whenever you like. The connection shows Reconnect and you paste the new one.
Given the choice, choose the provider's OAuth path. It is not about trusting us less. It is about needing to trust us less.
Run this on your own list.