What SendGrid answered
On 16.10.2026 we sent the same mail request to SendGrid several ways. The message depends on what the Authorization header contained:
| What we sent | SendGrid's message |
|---|---|
Bearer SG.… with a made-up key | The provided authorization grant is invalid, expired, or revoked |
Bearer with nothing after it | Permission denied, wrong credentials |
The key without the word Bearer | Permission denied, wrong credentials |
| No Authorization header | Permission denied, wrong credentials |
SMTP, user apikey, made-up key | 535 Authentication failed: The provided authorization grant is invalid, expired, or revoked |
| SMTP, user is an email address | 535 Authentication failed: Bad username / password |
So “authorization grant is invalid” means SendGrid read a key and rejected it. “Permission denied, wrong credentials” means it did not find a key in the form it expects.
The library sends “undefined” as a key
With @sendgrid/mail 8.1.6 we called setApiKey(process.env.SENDGRID_API_KEY) while the variable was unset. The library printed one warning, API key does not start with "SG.", and sent the request anyway. SendGrid answered with the same “authorization grant is invalid” 401, and the error had code: 401 and message: "Unauthorized". So this message can also mean the secret is simply not set on the server, which is the first thing to check when it works on your computer and not after deploy.
Fixing it
- In SendGrid, create a new API key with Mail Send access. SendGrid's docs say the console displays the key only once, at creation, so copy it then.
- Put it in the server's secrets (
SENDGRID_API_KEY) and redeploy or restart. A key that was deleted or regenerated stops working at once. - Send it as
Authorization: Bearer SG.…. For SMTP, the user is literallyapikeyand the password is the key. - Call SendGrid from a server. Its API answered the browser's preflight with
Access-Control-Allow-Origin: https://sendgrid.api-docs.io, so a call from your own site is blocked by CORS, and a key in page code would be public anyway.
SendGrid also runs a separate EU host, api.eu.sendgrid.com. With our fake key it gave exactly the same answer as the main host, so this error cannot tell you that you picked the wrong one; check which host your account was set up for.
Do you need a SendGrid key for a contact form?
If the API key is in your project only so a contact form can email you, a form that posts to Formgong at https://formgong.com/submit needs no key from a mail provider, and Formgong sends the notification. See the HTML guide.
Frequently asked questions
What does The provided authorization grant is invalid, expired, or revoked mean?
SendGrid found an API key in your request and did not accept it. The key was deleted, regenerated, mistyped, belongs to another account, or is the text undefined.
What is the difference from Permission denied, wrong credentials?
On our test SendGrid used that message when there was no usable Bearer key at all: an empty header, no header, or the key without the word Bearer.
What username does SendGrid SMTP need?
The word apikey, with the API key as the password. An email address as the user gave 535 Bad username / password on our test.
Sources and documentation
Official references for this guide: SendGrid: API keys, SendGrid: Integrating with the SMTP API, SendGrid: v3 API errors. HTML contact form, where data is stored.