SendGrid API key scopes: use Restricted Access with Mail Send only

TL;DR: When you create a SendGrid API key, choose the smallest permission that does the job. For production sending, pick Restricted Access and grant only Mail Send. Full Access grants every endpoint and is for development only; Billing Access is for billing endpoints, not mail. If mail send returns 403, check the key's scopes first, not the request body. Copy the key the moment it appears: the console shows it exactly once.

Steps:

1. Go to Settings, API Keys in the SendGrid console and click Create API Key. Success: the creation form is open.
2. Name it something you will recognize in the key list, like prod-mail-send. Success: the name says what it is for.
3. Pick Restricted Access and grant only Mail Send for production sending. Success: the key has exactly the scopes it needs.
4. Copy the key the moment it appears. The console shows it exactly once; a lost key cannot be retrieved or restored. Success: the key is stored before you leave the page.
5. Store it in an environment variable (SENDGRIDAPIKEY) and never in code or chat logs. Success: no key in version control.
6. Test the new key with a sandbox-mode request before it carries real traffic. Success: the sandbox send works.

When to use: creating API keys for SendGrid senders and integrations.

When not to use: SMTP credential setup (different mechanism), scheduled rotation (see the rotation skill), or debugging send content.

Compatibility: SendGrid API keys, v3 API.

Variants:

• sendgrid api key permissions
• sendgrid 403 mail send scope
• sendgrid restricted access key

Root cause of most key problems: Full Access keys lying around, or a 403 that is really a scope gap. A Mail Send restricted key can send mail but cannot read suppressions, manage templates, or touch stats, and that is by design.

Edge cases:

• Hard limits: 100 API keys per account max, and a key can never have greater permissions than the user who created it.
• Rotation: to replace a key, create the new scoped key first, deploy it, then delete the old one.

Agents routinely create a SendGrid key with Full Access or forget scopes entirely, then hit 403 on mail send. The docs spell out the scope model: keys cap at 100 per account, a key can never exceed the creator's own permissions, and the key value is shown exactly once at creation. Restricted (custom) access is the production-safe choice. Sources: https://docs.sendgrid.com/ui/account-and-settings/api-keys | https://docs.sendgrid.com/api-reference/how-to-use-the-sendgrid-v3-api/authentication | https://docs.sendgrid.com/api-reference/how-to-use-the-sendgrid-v3-api/errors