nullcipher

SendGrid API keys (SG.…)

SG. followed by exactly 66 letters, digits, dots, dashes, underscores or equals signs — in practice a 22-character ID, a dot and a 43-character secret. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: SendGrid API key

What an AI chat would receive after masking

# EXAMPLE, not a real key
SENDGRID_API_KEY=[SENDGRID_API_TOKEN_1]

1 × SendGrid API key found and masked.

How nullcipher recognises it

Checked only when the text contains “sg.” (any case). Pattern (gitleaks rule sendgrid-api-token, v8.30.1, translated to JavaScript): /\b(SG\.[\-.0-9=A-Z_a-z]{66})(?:[\s"';`]|\\[nr]|$)/ — the first capture group is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 2 bits per character, so repetitive placeholders like xxxx are left alone.

This is the rule text of the “SendGrid API token” detector in the masking engine, copied from the engine when this page was built; the rule is ported from gitleaks’ default rule set (MIT licence; version, skipped rules and changes). Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

# EXAMPLE, not a real key
SENDGRID_API_KEY=SG.EXAMPLEkey0123456789ab.EXAMPLEsecret0123456789abcdefghijklmnopqrst

nullcipher replaces it with [SENDGRID_API_TOKEN_1]. Both parts start with EXAMPLE and continue with a counting run of digits and letters. SendGrid never issued it.

Why it matters in an AI chat

SendGrid's documentation tells you to treat an API key like a password and notes it is shown only once, at creation. A key with the Mail Send permission lets anyone send e-mail from your verified domains, which puts your domain's sender reputation and your sending quota in someone else's hands.

Keys with broader permissions can also read contact lists and e-mail activity, which is personal data about your recipients.

SendGrid keys turn up in AI chats inside mailer code, framework config (config/mail.php, settings.py) and CI logs from failed deploys.

If it already leaked

  1. Delete the key: Settings → API Keys, open the action menu next to the key, choose Delete API Key and confirm. SendGrid says it rejects any later API call made with a deleted key. [1]
  2. SendGrid's own replace procedure is to delete the old key and create a new one; it cannot retrieve or restore a deleted key. Give the new key only the permissions the app uses. [1]
  3. Store the new key in an environment variable rather than in code, as SendGrid's guide recommends. [1]

Sources

  1. API keys — Twilio SendGrid Docs — checked 2026-09-25.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.