Share Mailgun/SendGrid Access Without Leaking API Keys (Scopes & Subaccounts)

Principles first

• People get roles, machines get scoped tokens—never share the main account password.
• Separate environments: production vs. staging via subaccounts or separate domains.
• Short-lived delivery: treat API keys like cash—share once, then lock away.

Safe patterns (works for both platforms)

• Use subaccounts/workspaces (or per-domain credentials) so one key can’t see everything.
• Create restricted API keys with the minimum scopes (send only, no account/admin).
• IP allowlists where available; pair with MFA/SSO for human logins.
• Rotate keys on handoffs/departures. Plan: Rotate Shared Credentials on a Schedule.

Secret delivery (don’t paste in chats)

• Send the key via a one-time, expiring link and share the access code by SMS/phone. Basics: The Safe Way to Share Passwords.
• Disable link previews to avoid auto-fetch: Prevent Accidental Link Previews.
• Never commit keys to repos—developer workflow: Share API Keys & .env Files (Safely).

Operational hygiene

• Alerts & logs: enable notifications for new keys, unusual sending, or increased bounces/blocks.
• Use a dedicated sending domain/subdomain and protect reputation with DMARC/SPF/DKIM. If marketing sends too, see: HubSpot Email-Sending Access.

Offboarding & incidents

• Revoke keys immediately, generate new ones, and re-deliver via the safe pattern above.
• Pause sends if abuse is suspected; review webhooks/templates.

Useful external references

• SendGrid: API key permissions 🔗
• Mailgun: API keys 🔗
• DMARC.org overview 🔗

Related reading

The Beginner’s Guide to Zero-Knowledge Sharing · Share Meeting Links & Recordings Safely · Audit Your Old Messages

Bottom line

Scope keys, isolate with subaccounts, restrict by IP, and deliver secrets ephemerally with fast rotation. That’s how email stays powerful—and safe.