sendgrid the provided authorization grant is invalid

SendGrid returns "535 Authentication failed: The provided authorization grant is invalid, expired, or revoked" (or a 401 Unauthorized on the Web API v3) when it rejects the credentials you presented. The OAuth-style phrasing is misleading: SendGrid SMTP and the v3 API authenticate with a single API key, not an OAuth authorization grant. The message simply means "the key you sent is not a valid, active, sufficiently-permissioned key."

What causes "the provided authorization grant is invalid" on SendGrid?

• The API key is wrong, mistyped, or truncated. SendGrid API keys are ~69 characters and begin with SG.. A trailing space, a line break, or copying only part of the key will fail. The key is shown only once at creation — if you lost it you must create a new one.
• The SMTP username is not apikey. For SMTP relay, the username must be the literal lowercase string apikey for every account — not your SendGrid login, email, or account name. The password is the full API key. Using your account username here is the single most common cause.
• The key was revoked or its permissions are too narrow. A deleted/revoked key, or a "Restricted Access" key without Mail Send permission, is rejected. SMTP relay in particular needs a key with Full Access or at least Mail Send.
• TLS below 1.2. SendGrid requires TLS 1.2+. A client (or an old .NET Framework / OpenSSL build) negotiating TLS 1.0/1.1 fails the handshake and surfaces as a 535. (Per RFC 4954, 535 5.7.8 is the standard "authentication credentials invalid" reply.)
• Wrong host/port or a blocked port. SMTP host must be smtp.sendgrid.net. Valid ports are 587, 25, or 2525 (STARTTLS) and 465 (implicit TLS). A firewall/ISP blocking these can present as an auth/connection failure.

How do I fix it?

1. Generate a fresh API key in SendGrid: Settings → API Keys → Create API Key, choosing Full Access (or a Restricted key with Mail Send enabled). Copy the entire SG.-prefixed string immediately.
2. For SMTP relay, configure exactly:
3. Host: smtp.sendgrid.net
4. Port: 587 (or 465 / 2525 / 25)
5. Username: apikey (literal)
6. Password: your full API key (no quotes, no whitespace)
7. For the Web API, send the key as a Bearer token:

Authorization: Bearer SG.xxxxxxxxxxxxxxxxxxxxxx

4. Confirm TLS 1.2+ is enabled in your client/runtime. On .NET Framework, set ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;.
5. Complete Sender Authentication (domain authentication or a verified single sender) so the key is allowed to send from your address.
6. Isolate with a raw test using OpenSSL to rule out your app code:

openssl s_client -starttls smtp -connect smtp.sendgrid.net:587 -crlf

Then issue AUTH LOGIN with base64-encoded apikey and your key.