Create a SendGrid API key

EonMailer authenticates to SendGrid with an API key, not your login password. Create a Restricted key with only the permissions required to send mail and read basic stats.

Step 1 — Open API keys

1. Log in to SendGrid (or the client’s subuser account).
2. Go to Settings → API Keys.
3. Click Create API Key.

Step 2 — Choose restricted access

1. Name the key clearly: eonmailer-acme-prod.
2. Select Restricted Access (never Full Access for production integrations).

Step 3 — Enable required scopes

Minimum for sending via EonMailer:

Scope	Access level	Why
Mail Send	Full	Required to send campaigns
Stats	Read (optional)	Dashboard sync if enabled
Template Engine	None	EonMailer renders templates
Marketing	None unless you use SendGrid MC separately	Avoid scope creep

Disable everything else unless EonMailer docs for your version explicitly list additional scopes.

Important Full Access keys cannot be scoped down later. If you accidentally created one, delete it and create a restricted replacement.

Step 4 — Copy and store the key

SendGrid shows the key once (starts with SG.).

1. Copy to password manager under client name + “SendGrid EonMailer”.
2. Never email the key or store in a Google Doc with broad sharing.

Step 5 — Subuser keys

If using subusers:

1. Impersonate or log into the subuser before creating the key.
2. Keys created at parent level won’t respect subuser isolation for sends.

Step 6 — Rotation

To rotate without downtime:

1. Create eonmailer-acme-prod-2026b key.
2. Update EonMailer provider settings.
3. Send test.
4. Delete old key in SendGrid.

Troubleshooting

• 401 Unauthorized — Wrong key, revoked key, or key created on wrong subuser.
• 403 Forbidden — Missing Mail Send scope on restricted key.

Next: Connect SendGrid to EonMailer.