SendGrid API Key Access Forbidden

SendGrid's access forbidden response is an HTTP 403: your API key authenticated successfully (otherwise you'd get a 401 Unauthorized), but it is not permitted to perform the specific action you requested. Unlike a 401, regenerating or re-pasting the key won't help — the key works; it just lacks the right scope.

What causes "SendGrid API Key Access Forbidden"?

A 403 from the SendGrid v3 API has three common, distinct causes:

1. Insufficient API key scope (most common). Each key carries a set of scopes (mail.send, stats.read, alerts.create, etc.). Calling an endpoint your key isn't scoped for returns 403. A classic case: a "Restricted Access" key with Mail permission set to No Access trying to POST /v3/mail/send, or a stats-only key hitting account settings.
2. IP Access Management blocking your source IP. If you've enabled IP Access Management (Settings -> IP Access Management), requests from any IP not on the allowlist are rejected with 403 — even with a Full Access key. This catches teams whose server/egress IP changed or who added the allowlist for one machine and call from another.
3. A required add-on isn't purchased. The Email Activity API specifically returns "403 Access Forbidden" unless the Additional Email Activity History add-on is on the plan and the key has the Email Activity scope. (Reseller accounts — Azure, GCP, Heroku, KKE — can't buy this add-on and should use the Event Webhook instead.)

How do I fix the 403 access forbidden error?

First, confirm which scopes your key actually has. Call the scopes endpoint with the same key your app uses:

curl -H "Authorization: Bearer $SENDGRID_API_KEY" \
  https://api.sendgrid.com/v3/scopes
# EU subusers: https://api.eu.sendgrid.com/v3/scopes

The response is a JSON object with a scopes array listing every scope the key holds (e.g. {"scopes":["mail.send","stats.read"]}). If the scope your call needs isn't there, that's your cause.

Then grant the missing scope. You do not have to recreate the key — SendGrid lets you edit an existing key:

1. Go to Settings -> API Keys.
2. Click the action (...) menu in the key's row -> Edit API Key.
3. Set the relevant scope to Full Access (all methods) or Read Access (GET only), or switch the key to Full Access.
4. Save, then retry — no app redeploy needed since the key string is unchanged.

When creating a new key, SendGrid offers Full Access, Restricted Access (per-scope: No Access / Read Access / Full Access), and Billing Access. Note: billing and Email Address Validation are managed separately and aren't covered by a Full Access key, and billing permissions are mutually exclusive with all other permissions.

One subtlety with teammates/subusers: you cannot grant a key more permission than the account or teammate that created it holds — SendGrid blocks privilege escalation. If you can't toggle a scope on, the parent account or your teammate role lacks it; have an admin grant it first.

If the scope is already correct, the 403 is environmental:

• IP Access Management: Settings -> IP Access Management. Add the public egress IP of the server making the call (check it with curl ifconfig.me from that host). Dynamic/cloud IPs are the usual culprit.
• Email Activity API only: Settings -> Account Details -> Your Products and add the email activity add-on, then allow up to ~12 hours for billing to propagate before retrying.