# Error: 401 Unauthorized or Forbidden

Source: https://catalystgroup.gg/docs/email-delivery/error-401-unauthorized-or-forbidden/
Updated: 2026-10-19 · By Duane Garner

An API mailer rejected CRM-NG SMTP's credentials (401) or refused the action (403). Check the key, its permissions and the region.

> **Shown by API mailers (Mailgun, Postmark, SparkPost, SendGrid, Mailjet, Resend and others):** The test result or the error log shows `401 Unauthorized`, `403 Forbidden` or simply `Forbidden` when CRM-NG SMTP sends through a service's web API.

 

This article is for site owners using any API-based mailer who see a 401 or 403 status. It is most common with **Mailgun**, **Postmark**, **SparkPost**, **SendGrid**, **Mailjet** and **Resend**.

 

## What this error means

 

API mailers send your email as a web request that carries a key or token. The service answers with a status number.

 
- **401 Unauthorized** means the service did not accept the credentials at all. The key is missing, mistyped, revoked, or sent to the wrong place.
- **403 Forbidden** means the service knows who you are but will not let you do this. The key lacks sending permission, the account is restricted, or the sender is not allowed.

 

Both stop the email before it is queued, so nothing is delivered.

 

## Common causes

 
- The key was pasted with a missing character or a space, or the wrong value was copied, such as a key ID or public key instead of the secret.
- The key was deleted or rotated in the service after you saved it.
- **Mailgun**: the key is fine but the **Region** is wrong. A key for an EU account will be refused by the US endpoint, and the reverse.
- **SparkPost**: the **Region** does not match the account (US or EU), or the key lacks the permission to send transmissions.
- **Postmark**: an account token was used instead of the **Server API Token**.
- **Mailjet**: the **API Key** and **Secret Key** are swapped or come from different key pairs.
- **SendGrid** or **Resend**: the key is restricted and does not include sending access.
- The service has limited the key to certain IP addresses and your server's IP is not on the list.

 

## How to fix

 
1. Find the right key page at the provider
  Mailgun: account menu, **API Security** (or **API keys**). Postmark: **Servers**, your server, **API Tokens**. SparkPost: **Configuration → API Keys**. SendGrid: **Settings → API Keys**. Mailjet: **Account settings → API Key Management**. Resend: **API Keys**.
2. Create a key with sending rights
  Make a new key or token that is allowed to send mail. Restricted keys are fine if sending is included.
3. Check the account region
  For Mailgun and SparkPost, note whether the account lives in the US or the EU. The address you sign in at usually tells you.
4. Update CRM-NG SMTP
  Go to **CRM-NG SMTP → Settings → General**. Use the **Remove** button next to the stored key, paste the new value, and set **Region** if your mailer has it. For Mailjet, fill both **API Key** and **Secret Key** from the same pair. Save.
5. Send a test
  Go to **CRM-NG SMTP → Tools → Email Test**, fill in **Send To** and press **Send Email**.

 

## Verify it worked

 

The test page shows "Test email sent successfully! Check your inbox to confirm delivery." The provider's activity or logs page shows the test message.

 

## Notes

 
- A 403 that persists with a fresh key usually points to the account: a pending review, an unverified sender or domain, or a suspension. Check for banners in the provider's dashboard.
- Microsoft 365 and Gmail have their own articles for their token errors; see [Troubleshooting](https://catalystgroup.gg/docs/email-delivery/troubleshooting/).
- If a field cannot be edited, the value is fixed in `wp-config.php`. See [secure settings with constants](https://catalystgroup.gg/docs/email-delivery/secure-settings-constants/).

 

## Related

 
- [Mailgun mailer guide](https://catalystgroup.gg/docs/email-delivery/mailer-mailgun/)
- [Postmark mailer guide](https://catalystgroup.gg/docs/email-delivery/mailer-postmark/)
- [SparkPost mailer guide](https://catalystgroup.gg/docs/email-delivery/mailer-sparkpost/)
- [SendGrid mailer guide](https://catalystgroup.gg/docs/email-delivery/mailer-sendgrid/)
- [Mailjet mailer guide](https://catalystgroup.gg/docs/email-delivery/mailer-mailjet/)
- [Resend mailer guide](https://catalystgroup.gg/docs/email-delivery/mailer-resend/)
- [Error: Invalid API key](https://catalystgroup.gg/docs/email-delivery/error-invalid-api-key/)
- [Troubleshooting email delivery](https://catalystgroup.gg/docs/email-delivery/troubleshooting/)