When you create a SendGrid API key, choose the smallest permission that does the job.
1. Go to Settings > API Keys in the SendGrid console and click Create API Key.
2. Name it something you will recognize in the key list, like prod-mail-send.
3. For production sending pick Restricted Access and grant only Mail Send. Full Access grants every endpoint and is for development only. Billing Access is for billing endpoints, not mail.
4. Copy the key the moment it appears. The console shows it exactly once; Twilio cannot retrieve or restore a lost key.
5. Store it in an environment variable (SENDGRID_API_KEY) and never in code or chat logs.
6. If mail send returns 403, the first thing to check is the key's scopes, not the request body. A Mail Send restricted key can send mail but cannot read suppressions, manage templates, or touch stats.
Hard limits to remember: 100 API keys per account max, and a key can never have greater permissions than the user who created it.
Rotation: to replace a key, create the new scoped key first, deploy it, then delete the old one. Test the new key with a sandbox-mode request before it carries real traffic.