# SendGrid “authorization grant is invalid”: 401 fix

SendGrid answers 401 with this message when it does not accept the API key. What we got from the live API with a fake key, the sibling messages and the fixes.

Author: Formgong
Published: 2026-10-16
Language: en
Canonical: https://formgong.com/en/blog/sendgrid-authorization-grant-invalid/

SendGrid sends this 401 when the API key in the Authorization header is not a key it accepts: deleted, regenerated, mistyped, from another account, or the string “undefined”. Create a new key with Mail Send permission, store it as a server secret and send it as “Bearer <key>”. Over SMTP the user name must be the word apikey and the password the key.

## What SendGrid answered

*Figure: A contact form shows an error after Send. The server log shows SendGrid answered 401 Unauthorized with the message The provided authorization grant is invalid, expired, or revoked.*

On 16.10.2026 we sent the same mail request to SendGrid several ways. The message depends on what the `Authorization` header contained:

SendGrid 401 messages
What we sentSendGrid's message

`Bearer SG.…` with a made-up key`The provided authorization grant is invalid, expired, or revoked`
`Bearer ` with nothing after it`Permission denied, wrong credentials`
The key without the word `Bearer``Permission denied, wrong credentials`
No Authorization header`Permission denied, wrong credentials`
SMTP, user `apikey`, made-up key`535 Authentication failed: The provided authorization grant is invalid, expired, or revoked`
SMTP, user is an email address`535 Authentication failed: Bad username / password`

So “authorization grant is invalid” means SendGrid read a key and rejected it. “Permission denied, wrong credentials” means it did not find a key in the form it expects.

## The library sends “undefined” as a key

With `@sendgrid/mail` 8.1.6 we called `setApiKey(process.env.SENDGRID_API_KEY)` while the variable was unset. The library printed one warning, `API key does not start with "SG."`, and sent the request anyway. SendGrid answered with the same “authorization grant is invalid” 401, and the error had `code: 401` and `message: "Unauthorized"`. So this message can also mean the secret is simply not set on the server, which is the first thing to check when it works on your computer and not after deploy.

## Fixing it

- In SendGrid, create a new API key with Mail Send access. SendGrid's docs say the console displays the key only once, at creation, so copy it then.

- Put it in the server's secrets (`SENDGRID_API_KEY`) and redeploy or restart. A key that was deleted or regenerated stops working at once.

- Send it as `Authorization: Bearer SG.…`. For SMTP, the user is literally `apikey` and the password is the key.

- Call SendGrid from a server. Its API answered the browser's preflight with `Access-Control-Allow-Origin: https://sendgrid.api-docs.io`, so a call from your own site is blocked by CORS, and a key in page code would be public anyway.

SendGrid also runs a separate EU host, `api.eu.sendgrid.com`. With our fake key it gave exactly the same answer as the main host, so this error cannot tell you that you picked the wrong one; check which host your account was set up for.

## Do you need a SendGrid key for a contact form?

If the API key is in your project only so a contact form can email you, a form that posts to [Formgong](/en/) at `https://formgong.com/submit` needs no key from a mail provider, and Formgong sends the notification. See the [HTML guide](/en/docs/html/).

## Frequently asked questions

### What does The provided authorization grant is invalid, expired, or revoked mean?

SendGrid found an API key in your request and did not accept it. The key was deleted, regenerated, mistyped, belongs to another account, or is the text undefined.

### What is the difference from Permission denied, wrong credentials?

On our test SendGrid used that message when there was no usable Bearer key at all: an empty header, no header, or the key without the word Bearer.

### What username does SendGrid SMTP need?

The word apikey, with the API key as the password. An email address as the user gave 535 Bad username / password on our test.

## Sources and documentation

- [SendGrid: API keys](https://www.twilio.com/docs/sendgrid/ui/account-and-settings/api-keys)
- [SendGrid: Integrating with the SMTP API](https://www.twilio.com/docs/sendgrid/for-developers/sending-email/integrating-with-the-smtp-api)
- [SendGrid: v3 API errors](https://www.twilio.com/docs/sendgrid/api-reference/how-to-use-the-sendgrid-v3-api/responses)
- [HTML contact form](https://formgong.com/en/docs/html/)

[Get a form key](https://formgong.com/en/#top)