Exposed SendGrid API Key? Here's how to detect and rotate it

A SendGrid API key (starting with SG.) authenticates requests to SendGrid's Mail Send API and can send email as your account. Anyone who has it can push mail through your verified sending domain and IPs. SendGrid shows the key only once at creation, so if it leaks you can't retrieve it — you have to delete it and make a new one.

What an attacker can do with a leaked SendGrid API Key

• Sends spam and phishing from your verified domain, so recipients and filters see it as legitimately from you.
• Trashes your sender reputation and domain reputation, so your real emails start landing in spam or bouncing.
• Burns your sending quota and can push your account into rate limits or a compliance suspension.
• Reads account data the key's scopes allow — templates, suppression lists, contacts, and sending stats.

How SendGrid API Keys get exposed

• Committed to a public repo in a .env, config file, or CI workflow.
• Hardcoded in a mobile app, browser bundle, or serverless function that got shared.
• Pasted into a screenshot, support ticket, or chat when debugging email sending.
• Left in server logs or an error trace that logged the Authorization header.

How to rotate a leaked SendGrid API Key

1. Go to app.sendgrid.com/settings/api_keys and sign in.
2. Find the leaked key, click the action menu (three dots) in its row, and select Delete — SendGrid rejects it immediately after.
3. Click ‘Create API Key,’ give it Restricted Access with only the scopes you need (usually just Mail Send), and copy it once.
4. Update your server environment or secrets manager with the new key and redeploy.
5. Rotate any other credentials that sat next to it, since a leaked repo or log usually exposes more than one.
6. Open the Email Activity feed at app.sendgrid.com/email_activity and check Stats for sends you didn't make, then report abuse to SendGrid if you see spam going out.

Open the SendGrid API Key dashboard →