SendGrid in a Next.js API route: server-only key, @sendgrid/mail

TL;DR: Send mail from a Next.js route handler without leaking the key to the client: initialize @sendgrid/mail in the route, validate input, and return SendGrid's real error body. Never import this module or the key into a client component. Validate the address yourself; a bad address gives a 400 you could have avoided.

The error

)) {
    return Response.json({ error:

The fix

app/api/invite/route.js:

import sgMail from '@sendgrid/mail' sgMail.setApiKey(process.env.SENDGRIDAPIKEY)

export async function POST(req) { const { email } = await req.json() if (!email || !email.includes('@')) { return Response.json({ error: 'valid email required' }, { status: 400 }) } try { await sgMail.send({ to: email, from: '[YOURVERIFIEDSENDER]', // verified sender subject: 'Your invite', text: 'Welcome aboard', }) return Response.json({ sent: true }, { status: 202 }) } catch (error) { const body = error.response && error.response.body console.error(body) return Response.json({ sent: false, detail: body }, { status: 502 }) } }

Rules:

1. The key lives in server env only. Never import this module or the key into a client component.
2. Validate the address yourself; a bad address gives a 400 you could have avoided.
3. Rate-limit the route or add a captcha if it is public; an open mail endpoint gets abused fast.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: SendGrid in a Next.js API route.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current SendGrid behavior.

Next.js App Router route handlers run server-side, which is where the SendGrid key must live. The send pattern is @sendgrid/mail per the official Node quickstart; the from address must be a verified sender per the mail send reference. Sources: https://github.com/sendgrid/docs/blob/develop/content/docs/for-developers/sending-email/quickstart-nodejs.md | https://docs.sendgrid.com/api-reference/mail-send/mail-send