# Error: Authorization grant invalid or expired (SendGrid)

Source: https://catalystgroup.gg/docs/email-delivery/error-sendgrid-authorization-grant-invalid/
Updated: 2026-10-19 · By Duane Garner

SendGrid does not accept the API key saved in the plugin. It is mistyped, deleted or from another account. Create a new key and save it.

This article is for sites using the **SendGrid** mailer where sending fails with "The provided authorization grant is invalid, expired, or revoked".

 

> **The error as you see it:** `The provided authorization grant is invalid, expired, or revoked`
>  
> Shown by the **SendGrid** mailer, in the failed-send banner (as "Invalid SendGrid API key."), in **Tools → Debug Events** and in the **Email Log**. SendGrid returns it with HTTP status 401.

 

## What this error means

 

The plugin sends each email to SendGrid with your **API Key** attached. SendGrid looked the key up and could not match it to a working key. It never got as far as checking your sender or recipients. SendGrid API keys do not expire on a schedule, so in practice "expired or revoked" means the key was deleted, or the plugin holds something that was never a valid key.

 

## Common causes

 
- **The key was deleted** in SendGrid, perhaps during a clean-up or by another team member.
- **Part of the key is missing.** SendGrid keys are long and start with `SG.`; copying can drop characters or add a space.
- **The key belongs to a different SendGrid account** or subuser than you think.
- **The key ID was saved instead of the key.** SendGrid shows the full key only once, when it is created; the list afterwards shows only a short ID.
- **A constant in wp-config.php** still holds an old key.

 

## How to fix

 
1. Sign in to SendGrid
  Go to `https://app.sendgrid.com/` with the account that owns your sending domain.
2. Open API keys
  Go to **Settings → API Keys**. If the key the site used is not listed, it was deleted.
3. Create a new key
  Choose **Create API Key**, name it after your site, and pick **Restricted Access** with only **Mail Send** set to full access (that is all the plugin needs). Create it and copy the key immediately; SendGrid will not show it again.
4. Save it in CRM-NG SMTP
  In **CRM-NG SMTP → Settings → General**, with **SendGrid** selected, use **Remove API Key**, paste the new key into **API Key**, and press **Save Settings**.
5. Check for constants
  If the API Key field cannot be edited, the key is set with a `CRMNG_SMTP_*` constant in `wp-config.php`. Update it there.
6. Delete the old key
  Back in **Settings → API Keys**, delete any key no longer in use.
7. Send a test
  Go to **CRM-NG SMTP → Tools → Email Test**, fill in **Send To** and press **Send Email**.

 

## Verify it worked

 

The test page shows "Test email sent successfully! Check your inbox to confirm delivery." In SendGrid, **Activity Feed** lists the test message.

 

## Notes

 
- If SendGrid now accepts the key but refuses to send with "not authorized to send", the key exists but lacks permission or the account is restricted: see [Authenticated user not authorized to send](https://catalystgroup.gg/docs/email-delivery/error-sendgrid-user-not-authorized/).
- Keep one key per site. Then deleting a key for one site never breaks another.

 

## Related

 
- [SendGrid](https://catalystgroup.gg/docs/email-delivery/mailer-sendgrid/)
- [Error: Authenticated user not authorized to send (SendGrid)](https://catalystgroup.gg/docs/email-delivery/error-sendgrid-user-not-authorized/)
- [Error: Invalid API key](https://catalystgroup.gg/docs/email-delivery/error-invalid-api-key/)
- [Troubleshooting email delivery](https://catalystgroup.gg/docs/email-delivery/troubleshooting/)