Detection reference · Credentials and secrets · Updated 2026-11-03

SendGrid API keys (SG.)

A SendGrid key can send email from your verified domains, which makes it valuable for phishing. Its two-part format is distinctive.

At a glance

Reported as	API key or token
Category	Credentials and secrets
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[SECRET]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 205

What it looks like

SG. followed by 22 characters, a dot, and 43 characters (letters, digits, hyphens or underscores).

Example

You paste

SENDGRID_API_KEY=SG.RedaxaDocsSampleNotRea.RedaxaDocsSampleNotRealRedaxaDocsSampleNotR

Redaxa returns

SENDGRID_API_KEY=[SECRET]

Reported as	API key or token
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[SECRET]`
Probable service	SendGrid
Credential type	API key
Evidence	SendGrid key format; account and permissions are not verified.
Recommended action	Revoke or rotate if genuine

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

config/mail.env: Unattributed token candidate, listed for review (severity medium). Only a generic token prefix or Bearer label matched. It could be an example or ordinary identifier. Kept for context, without a high-confidence API alert; this is not proof of a working secret.
Same value in tests/fixtures/mail.env: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

SENDGRID_API_KEY=SG.RedaxaDocsSampleNotRea: not flagged. Only the first part of the format: not a key.

If it already leaked

Delete the key in SendGrid (Settings, API Keys), create a replacement with only the permissions you need, and check the activity feed for messages you did not send.

What Redaxa adds to every finding of this kind: If genuine, revoke or rotate it at the issuing service, update the application, then remove the exposed value from code and review Git history. Deleting it from Git does not revoke access.

Official guidance: www.twilio.com.

Step by step: pasted a key into ChatGPT, or committed one to GitHub.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Worried it is already in your code? Check a public GitHub repository free (3 checks a day).

Sources

Redaxa engine: scanner.ts line 205, credential-context.ts line 41 (SendGrid). Every output on this page was produced by that code when the page was built.
Twilio SendGrid Docs: API keys