SendGrid 401 authorization required: the key is missing, malformed, or dead

Not specified by the original author.

Symptom: POST to the v3 API returns 401 with an errors array whose message is authorization required.

1. Confirm the request carries an Authorization header with the API key as the Bearer value, exactly: one header, one space, no extra quotes.
2. Read the key from the environment at runtime. A pasted key with a trailing newline or space fails auth; the SMTP doc warns about this too.
3. Check the key still exists: Settings > API Keys. Deleted keys are gone for good, Twilio cannot restore them, and they 401.
4. Make sure you are hitting https://api.sendgrid.com/v3/... A wrong base URL or a proxy that strips headers also 401s.
5. Do not confuse 401 with 403. 401 is authentication (who are you), 403 is authorization (you are known but not allowed). If the key works on one endpoint and 403s on mail send, the problem is scopes or the from address, not the key.

Quick test: curl -H with your header against GET https://api.sendgrid.com/v3/scopes with the key in the header. A 200 means the key is alive; then look at scopes.

The v3 API errors doc: 401 means authorization required, 403 access forbidden, 400 invalid request, 413 content too large, 429 too many requests, and every failed request returns an errors array with field and message. The auth doc: authenticate with an Authorization header carrying the API key as the Bearer value. Sources: https://docs.sendgrid.com/api-reference/how-to-use-the-sendgrid-v3-api/errors | https://docs.sendgrid.com/api-reference/how-to-use-the-sendgrid-v3-api/authentication