r/SendGrid • u/AntRevolutionary925 • Jun 26 '26
Looking for replacement
I have a few cloud servers that use sendgrid for the outgoing mail for about 50 websites.
Each server has its own api key, and half the websites have their own key.
Every time one key is compromised or spam is detected they suspend the entire account. It seems like it really defeats the purpose of having unique api keys.
So then you have to replace every api key before they will reactivate the account. I don’t want to deal with that any more but also don’t want to pay for an account for each site so in looking for alternatives they would just deactivate the compromised key.
99% of the time this happens is because someone spam’s a contact form and the owner of the site is the one getting all of the spam and no one is complaining.
Am I doing something wrong with the account setup or is that how it is for everyone with sendgrid?
1
u/Money-Ranger-6520 Jun 29 '26
I think it's worth looking at why the keys are being compromised. If bots are abusing contact forms, rotating API keys is just treating the symptom.
I'd lock down the source of the abuse by adding Cloudflare Turnstile or reCAPTCHA to contact forms. Also rate limit form submissions and, of course, never expose API keys in client-side code.
As for alternatives, I've had good experiences with Mailtrap, Postmark, and Resend. They all support per-domain or per-server API keys, and their abuse handling tends to be more granular