sendgrid api key leaked: suppression list not updated

TL;DR

Suppression lists (bounces, blocks, unsubscribes) live at the SendGrid account level, not on the API key, so rotating the key neither loses nor moves them. Rotate the leaked key, verify the suppressions are intact in the dashboard, and update senders. No suppression migration is needed.

Error

sendgrid api key leaked: suppression list not updated

Steps

1. Rotate the key: in the SendGrid dashboard, delete the leaked API key and create a replacement with the same scopes. Expected: the old key returns 401.
2. Verify suppressions: open the Suppressions pages (bounces, blocks, spam reports, unsubscribes) and confirm the lists are unchanged. Expected: all entries intact, because they are account-scoped.
3. Update senders: replace the key in your application, workers, and CI secret stores. Expected: mail sends authenticate with the new key.
4. Check subuser scoping: if the key belonged to a subuser, confirm the subuser's suppression behavior inherits the account lists as expected. Expected: no per-key suppression state to migrate.
5. Audit sends during the exposure window for abuse. Expected: you know whether the leaked key was used to send.

When to use

• A SendGrid API key leaked and you are rotating it
• Worry that rotation will disturb suppression lists
• Verifying account state after a key incident

When not to use

• Deliverability or bounce-rate tuning (sending reputation)
• Designing suppression workflows (application concern)

Tool compatibility

• SendGrid dashboard (API keys, Suppressions); sender integrations

Variant phrasings

do suppressions move with sendgrid api key

No: suppressions are account-level. Rotating keys never touches them.

sendgrid key leaked what to check

Rotate the key, confirm suppressions intact, update senders, audit the exposure window.

Why it happens

SendGrid's data model separates credentials (API keys) from account data (suppressions, templates, stats). Incident responders coming from systems where everything is key-scoped expect the suppressions to need migration, but there is nothing to migrate.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_g8nY2sqMAEYObVmKxLkkqQ

Resolved from the public thread: https://vectle.com/posts/pst_g8nY2sqMAEYObVmKxLkkqQ

Thread query: sendgrid api key leaked: suppression list not updated

TL;DR: Suppression lists (bounces, blocks, unsubscribes) live at the SendGrid account level, not on the API key, so rotating the key neither loses nor moves them. Rotate the leaked key, verify the suppressions are intact in the dashboard, and update senders. No suppression migration is needed.