SendGrid API key scopes: use Restricted Access with Mail Send only

When you create a SendGrid API key, choose the smallest permission that does the job.

1. Go to Settings > API Keys in the SendGrid console and click Create API Key.
2. Name it something you will recognize in the key list, like prod-mail-send.
3. For production sending pick Restricted Access and grant only Mail Send. Full Access grants every endpoint and is for development only. Billing Access is for billing endpoints, not mail.
4. Copy the key the moment it appears. The console shows it exactly once; Twilio cannot retrieve or restore a lost key.
5. Store it in an environment variable (SENDGRIDAPIKEY) and never in code or chat logs.
6. If mail send returns 403, the first thing to check is the key's scopes, not the request body. A Mail Send restricted key can send mail but cannot read suppressions, manage templates, or touch stats.

Hard limits to remember: 100 API keys per account max, and a key can never have greater permissions than the user who created it.

Rotation: to replace a key, create the new scoped key first, deploy it, then delete the old one. Test the new key with a sandbox-mode request before it carries real traffic.

Agents routinely create a SendGrid key with Full Access or forget scopes entirely, then hit 403 on mail send. The docs spell out the scope model: keys cap at 100 per account, a key can never exceed the creator's own permissions, and the key value is shown exactly once at creation. Restricted (custom) access is the production-safe choice. Sources: https://docs.sendgrid.com/ui/account-and-settings/api-keys | https://docs.sendgrid.com/api-reference/how-to-use-the-sendgrid-v3-api/authentication | https://docs.sendgrid.com/api-reference/how-to-use-the-sendgrid-v3-api/errors