SendGrid API + MCP (2026): v3 REST, 7 SDKs, docs-only MCP

SendGrid’s modern surface is the v3 REST API at https://api.sendgrid.com/v3/, authenticated with an API key sent as a bearer token, plus a first-party SMTP relay using the same credential. Twilio maintains 7 official SDKs across roughly 30 resource groups. On MCP the answer is narrower than the noise suggests: Twilio ships an official server, but it only reads documentation.

At a glance

MCP integration in 2026

The MCP question splits in two: can an agent read the API schemas reliably, and can it execute against the account. SendGrid answers yes to the first and no to the second.

Available MCP servers

Six servers are worth knowing. The two OFFICIAL entries come from Twilio and neither is a general-purpose SendGrid email tool. The rest wrap the v3 API and deserve the scrutiny you give any unsupported dependency holding a live key.

SendGrid API essentials

Everything modern lives under /v3/. There is one transactional send endpoint and a much larger Marketing Campaigns surface with different pagination and a different object model — treating them as one API is the commonest confusion.

Two pagination models is a migration hazard. A helper that walks limit and offset returns the same first page forever against /v3/marketing/lists, which ignores offset and expects you to follow _metadata.next until it is absent. Write one pager that branches on _metadata. A third interface is easy to forget: the SMTP relay accepts an X-SMTPAPI header carrying JSON instructions — substitutions, categories, unsubscribe groups, scheduling.

Authentication methods

API key as bearer token

The primary method for every v3 endpoint. Create the key under Settings › API Keys and send it as Authorization: Bearer SG.xxxx. Keys are shown once at creation, and the same string doubles as the SMTP password — a leaked key is a full-send compromise unless you constrained it.

Scoped API keys

Keys can be restricted to specific permission scopes instead of Full Access. A transactional sender should carry Mail Send and nothing else — the difference between a leaked credential that can send spam and one that can also read your contact database. GET /v3/scopes returns the scopes on the calling key.

on-behalf-of and subusers

A parent-account key acts as one of its subusers by adding on-behalf-of: <subuser_username>. This is how multi-tenant platforms isolate reputation per client without minting a key per tenant. Subuser management is Pro tier and above.

SMTP AUTH

The relay authenticates with AUTH LOGIN over STARTTLS or implicit TLS. The username is the literal lowercase string apikey and the password is the full API key. Port and TLS detail lives on the SMTP settings tab.

OAuth 2.0 (outbound only)

OAuth 2.0 client credentials exists for the Event Webhook, where SendGrid is the client: it fetches a token from your Token URL and presents it when POSTing events. It is not an inbound auth method for the REST API.

Rate limits

SendGrid publishes no emails-per-hour cap anywhere. Throughput is bounded by your plan’s monthly volume, dedicated-IP warmup state, and per-endpoint limits that are enforced but unnumbered. Read the headers instead: every v3 response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (a Unix timestamp). Back off as Remaining nears zero and sleep until Reset on an HTTP 429 rather than pinning a rate in config. Teams needing a contractual figure end up on Amazon SES, where the send rate is an explicit, raisable quota.

Official SDKs

Twilio maintains 7 first-party libraries under the sendgrid GitHub organisation. All wrap the same v3 surface; the mail helpers differ in ergonomics, not capability. Alongside them sit smtpapi header helpers and Event Webhook signature-verification helpers for the same languages.

Notable community SDKs

Most teams reach SendGrid through a framework bridge. Symfony ships an official transport, symfony/sendgrid-mailer, driven by a sendgrid:// DSN. Django users take Anymail, whose backend also handles inbound and tracking webhooks. On Drupal, the SendGrid Integration module sends through the Web API; on WordPress the dominant route is WP Mail SMTP’s SendGrid mailer, which routes wp_mail() through the API rather than SMTP.

Endpoints reference

The fifteen resources below carry the traffic in most integrations. Full schemas are in the official v3 API reference.

Code examples

Verifying a key and its scopes

The cheapest auth check there is: it tells you not just whether the key is valid but what it may do — the real question when a send returns 403.

curl -sS -X GET "https://api.sendgrid.com/v3/scopes" \
  -H "Authorization: Bearer $SENDGRID_API_KEY"

# 200 OK -> { "scopes": [ "mail.send", ... ] }
# 401 means the key is wrong or revoked. A 200 whose scopes
# array lacks "mail.send" is why your send returns 403.

Sending with Python

# pip install sendgrid
import os
import sendgrid
from sendgrid.helpers.mail import Mail, Email, To, Content

sg = sendgrid.SendGridAPIClient(api_key=os.environ.get('SENDGRID_API_KEY'))

message = Mail(
    Email('sender@yourdomain.com'),
    To('recipient@example.com'),
    'Sending with SendGrid is Fun',
    Content('text/plain', 'and easy to do anywhere, even with Python')
)

response = sg.client.mail.send.post(request_body=message.get())
print(response.status_code)  # 202 Accepted
print(response.headers.get('X-Message-Id'))

Sending with Node.js

// npm install --save @sendgrid/mail
const sgMail = require('@sendgrid/mail');
sgMail.setApiKey(process.env.SENDGRID_API_KEY);

const msg = {
  to: 'recipient@example.com',
  from: 'sender@yourdomain.com', // verified sender or authenticated domain
  subject: 'Sending with Twilio SendGrid is Fun',
  text: 'and easy to do anywhere, even with Node.js',
};

(async () => {
  try {
    const [response] = await sgMail.send(msg);
    console.log(response.statusCode); // 202
  } catch (error) {
    if (error.response) console.error(error.response.body);
  }
})();

Common gotchas

Deprecations and changelog

• August 3, 2026 — The “Send to a coworker” action was removed from the domain authentication flow, citing low usage and the risk of DNS values being mangled in transit.
• June 2, 2025 — Notice that from July 9, 2025, recipients per Web API v2 mail send request would drop from 10,000 to 1,000.
• May 27, 2025 — Free Email API and Free Marketing Campaigns plans retired over a 60-day transition; accounts over 100 contacts lost them unless they upgraded.
• April 23, 2024 — Regional Email Sending (EU) launched for Pro and above: EU subusers, EU dedicated IPs and the https://api.eu.sendgrid.com base URL.
• May 3, 2023 — Event Webhook gained multiple endpoints per account, each subscribable to a different set of event types.

Track changes at the official Twilio changelog. There is no SendGrid-only feed, so filter by product.

Frequently asked questions