Authenticate a SendGrid domain and scope the API key

SendGrid’s production setup combines account security, a verified sender identity, and a scoped API key. A test sender and a fully authenticated application domain are not interchangeable deployment states.

Establish the approved sender

1. Complete the account’s required security and approval steps, including two-factor authentication where required.
2. Configure Domain Authentication and publish the exact DNS records supplied for your domain.
3. Create a Restricted Access API key with the Mail Send permission needed by the application. Do not enable unrelated account administration.
4. Store it as a backend secret and document the permitted sender/domain and environment.

The official Node.js quickstart explains sender verification and API permissions. Single Sender verification can support onboarding, but should not be mistaken for your completed production DNS plan.

Verify independently from inbound

Make one controlled send and inspect the relevant SendGrid activity. A domain-authentication success does not configure Inbound Parse or authorize changing an employee mailbox’s MX records.

Distinguish a permission error from a sender-verification error before rotating keys. Never put the key into a frontend bundle, query string, issue report, or email sample.

If migrating an application, retain the old configuration as a deliberate rollback choice and avoid sending through both transports simultaneously. MailKite’s domain verification and sending credentials are independent from SendGrid’s.