How to rotate your SendGrid API key

Updated October 2026

SendGrid API keys can be created and deleted by API, once you have one existing key with the right scope to do it. There's no Dashboard click required for a routine swap.

Here's the exact process, from SendGrid's own docs.

The manual steps

1. Make sure you have an existing key with the api_keys.create scope. The very first key with that scope has to be made once in the SendGrid app, under Settings > API Keys.
2. Create the new key: POST https://api.sendgrid.com/v3/api_keys, Authorization: Bearer <admin_key>, body {"name": "...", "scopes": [...]}. SendGrid's own docs, checked November 24, 2026, warn that leaving scopes out creates a Full Access key, so list only what this integration actually needs, usually just mail.send.
3. Copy the api_key value from the 201 response right away. It's shown once.
4. Swap the new key into every place the old one lived: environment variables, CI secrets, any function that sends mail.
5. Confirm mail still sends with the new key, then delete the old one: DELETE https://api.sendgrid.com/v3/api_keys/{api_key_id} with the admin key, which returns 204.

What breaks if you miss a place

A key with api_keys.delete scope can delete any key on the account, including itself. If the key your rotation script uses has that scope and the script has a bug, it can take out every key on the account in one run, not just the one it meant to rotate. Keep the rotating key's own scopes as narrow as whatever it's actually rotating.

How to check the old key is actually dead

Call GET https://api.sendgrid.com/v3/scopes with the old key. SendGrid's documented behavior for any /v3 call with a bad bearer token is a 401. One honest gap: the specific reference page for that endpoint returned a 404 when we checked it on November 24, 2026, so confirm the exact response once against a real account before you depend on it in code.

Why the first key has to be made by hand

SendGrid's API can create and delete keys, but it can't create the account's first key with that permission. Someone has to open the app once, make a key with api_keys.create, and hand it to whatever automates the rest. Every rotation after that first one can run without a person.

Or let Key Robot do it

Key Robot does this for you today. It makes the new key with the same rights as the old one, puts it in your app, checks your app still works, and then deletes the old key. Your manager key needs every right your app's key has, so Full Access is simplest.

One honest catch: SendGrid keeps accepting a deleted key for a while. In our test on October 26, 2026, a deleted key kept working for about 10 minutes. So the robot tells you when an old key still answers, instead of calling it dead.

See how to rotate your Resend key for the email service Key Robot already handles, or the rotate hub for everything on the roadmap.