KeyVault.
Python / FastAPI

Secure Your SendGrid API Key in Python

SendGrid keys in Python apps are often stored in Django settings.py or Flask app.config, both of which appear in debug tracebacks. A leaked key with Mail Send permission lets attackers send phishing emails from your verified domain. KVE tokens are host-bound.

The Problem

This is what most Python codebases look like today. The SENDGRID_API_KEY key (SG.) lives directly in the process environment. If your repo, your CI logs, or your deployment config leaks — so does your key.

Python
# email.py — real SendGrid key in environment
import os
import sendgrid
from sendgrid.helpers.mail import Mail

sg = sendgrid.SendGridAPIClient(api_key=os.environ["SENDGRID_API_KEY"])

def send_welcome_email(to_email: str, name: str) -> None:
    message = Mail(
        from_email="hello@myapp.com",
        to_emails=to_email,
        subject=f"Welcome to MyApp, {name}!",
        html_content=f"<p>Hi <strong>{name}</strong>, thanks for signing up.</p>",
    )
    sg.send(message)

The Fix

Send the request to the KeyVault Edge proxy at https://proxy.keyvaultedge.com with the provider's usual path, your kvt_ token in X-KV-Token and the provider's base URL in X-KV-Target. The proxy refuses requests whose Origin isn't on the token's allowed hosts, then injects your real SENDGRID_API_KEY, so it never sits in your app's environment.

Python
# email.py — KVE_TOKEN is host-bound; SendGrid key not in process
import os
import httpx

KVE_TOKEN = os.environ["KVE_TOKEN"]

def send_welcome_email(to_email: str, name: str) -> None:
    response = httpx.post(
        "https://proxy.keyvaultedge.com/v3/mail/send",
        headers={
            "X-KV-Token": os.environ["KVE_TOKEN"],  # kvt_... token
            "X-KV-Target": "https://api.sendgrid.com",
            # Must match one of the token's allowed hosts
            "Origin": os.environ["APP_ORIGIN"],
            "Content-Type": "application/json",
        },
        json={
            "from": {"email": "hello@myapp.com"},
            "personalizations": [{"to": [{"email": to_email}]}],
            "subject": f"Welcome to MyApp, {name}!",
            "content": [
                {
                    "type": "text/html",
                    "value": f"<p>Hi <strong>{name}</strong>, thanks for signing up.</p>",
                }
            ],
        },
        timeout=10.0,
    )
    response.raise_for_status()

Setup in 4 steps

1

Create a KVE token for SendGrid

At keyvaultedge.com, create a token with your SG. API key. Select provider SendGrid and add your Python server's hostname as an allowed host. Use a restricted SendGrid key (Mail Send only, not Full Access).

2

Update your environment

Replace SENDGRID_API_KEY with KVE_TOKEN in .env or your deployment secrets.

Shell
# .env
KVE_TOKEN=kvt_...your_token
APP_ORIGIN=https://yourdomain.com  # one of the token's allowed hosts

pip install httpx
# pip uninstall sendgrid  # optional
3

Replace the sendgrid SDK with httpx

Remove the sendgrid import and Mail helper. Use httpx.post. Point the request at https://proxy.keyvaultedge.com with the provider's usual path (e.g. /v3/mail/send), send your token in X-KV-Token, the provider's base URL (https://api.sendgrid.com) in X-KV-Target, and an Origin header matching one of the token's allowed hosts. The body is the provider's normal request body; the proxy sets the provider's auth header with your real key and forwards it.

4

Restrict token to mail/send endpoint

In the KeyVault Edge dashboard, add an endpoint path allowlist: only allow /v3/mail/send for your SendGrid token. This blocks any attempt to access contact lists, suppressions, or API key management through this token.

What this protects, and what it doesn't

  • Your real SENDGRID_API_KEY stays at the edge, so it can't leak from your repo, logs, bundle or server environment.
  • The kvt_ token is still a credential. A copied token can be replayed by anyone who can send the right headers, including a fake Origin from a server. The protection is that each token has its own rate limits, monthly cost cap and endpoint scope, and you can revoke it in one click without rotating the provider key.
  • The cost cap is estimated from the usage the provider reports, so a request already in flight can overshoot it slightly.

Plans and limits are on the pricing page.

Start protecting your keys

Your SendGrid key is one leaked .env file away from being exploited. With KeyVault Edge the real key stays at the edge, and the token that replaces it is capped, scoped and revocable in one click.

Get started View all guides