SendGrid click tracking rewrites links and breaks signed URLs
Links work in tests but fail in sent mail with invalid-signature or expired-token errors because SendGrid click tracking wraps links in a redirect. Covers confirming the cause, per-message and per-link opt-out. Not for open tracking or links that were broken before sending.
TL;DR: Click tracking wraps every link in a SendGrid redirect, which breaks signed URLs, password-reset tokens, and any link whose signature covers the exact URL. Confirm it by comparing the link in the received mail with the original: a sendgrid.net redirect wrapper means the signature no longer matches. Disable tracking per message (trackingsettings.clicktracking.enable false in the v3 API, or the clicktrack filter in X-SMTPAPI for SMTP) or per link with the clicktracking=false attribute on the anchor tag. Do not disable tracking globally to fix one flow.
What it looks like:
Symptom: links work in tests but fail in sent mail with invalid-signature or
expired-token errors.Steps:
- Confirm click tracking is the cause: compare the link in the received mail with the original. Success: you see the sendgrid.net redirect wrapper.
- Disable for the message: trackingsettings.clicktracking.enable false (v3 API) or the clicktrack filter (SMTP). Success: the setting is off for that send only.
- Or disable for one link inside an otherwise tracked mail: add clicktracking=false to that anchor tag. Success: that link arrives byte-identical, the rest still tracked.
- Resend and verify the raw link survives byte-identical. Success: signatures validate.
When to use: signed or tokenized links failing only in sent mail.
When not to use: links broken in tests too (the bug is yours), open-tracking questions, or engagement data you actually want to keep (use the per-link opt-out).
Compatibility: SendGrid v3 API and SMTP, all plans with click tracking.
Variants:
- sendgrid click tracking breaks signed url
- sendgrid password reset link invalid
- disable click tracking one link
Root cause: the signature was computed over the original URL, and click tracking changes the URL the recipient clicks. The signature check then fails, correctly, against a URL it never signed.
Edge cases:
- Rule: any URL carrying a cryptographic signature or single-use token goes out untracked.
- Do not disable tracking globally to fix one flow. You lose engagement data everywhere for a local problem.