If you're experiencing issues with your API keys, such as failed API calls, unexpected deactivations, or security emails, review the following tips before contacting our support team.
I get an "Access denied for resource" error
An API call fails and the response says the API key doesn't include the required permission. The message looks like this: Access denied for resource "account". The API key does not include the required permission. Update the key permissions or send the request with a different key. The resource name changes depending on the call.
Common causes and solutions
Expand the following accordions to learn more about each cause:
The resource named in the error is one the key can't reach, or can't use in the way the call requires. For example, a key with Read permission can view a resource but can't change it, and deleting requires All. This can also happen if the permissions of the key were reduced when it was edited.
Solution: Edit the key and set the permission level the call needs for that resource. To learn more, check our dedicated article Create and manage your API keys. Only the account owner or users with the API keys permission can edit a key.
If your account has several API keys, the integration may use a key whose permissions don't include the resource.
Solution: Compare the last digits of the key your integration uses with the ones displayed on the API Keys & MCP page. Then update the permissions of that key, or switch the integration to a key that has the required permission.
Verify the fix
Send the same API call again with the updated key and check that it no longer returns the error.
If the issue persists, contact our support team and include the last digits of the key and the exact error message you received.
My API key shows "No fixed date" but I received an inactivity warning
You didn't set an expiration date when creating your API key, but you still received an email warning that the key will be deactivated for inactivity.
Cause and solution
The expiration date and the inactivity rule are two separate settings. No expiration only means the key has no fixed expiry date. Any key that hasn't made a successful API call in 90 days is deactivated, regardless of its expiration setting.
Solution: Confirm that your integration uses this specific key, as it may use a different key from your account. Then make sure it makes at least one successful API call before the 90 days end. If the key is already deactivated, you can reactivate it. To learn more, check our dedicated article Create and manage your API keys.
Verify the fix
Make a test API call with the key, then check on the API Keys & MCP page that its status is Active and that Last used on shows today's date.
If the issue persists, contact our support team and include the last digits of the key and the exact warning message you received.
I received a "Verify a new IP" security email
You received an email from Brevo asking you to confirm or deny an API call made from an unrecognized IP address, and you're not sure whether it's legitimate.
Cause and solution
If the blocking of unknown IP addresses is activated on your account, Brevo sends this email whenever it detects an API call from an IP address that hasn't been used before. It doesn't necessarily mean something is wrong. A legitimate integration, such as a new server or third-party tool, can trigger it when it connects for the first time.
Solution: If you recognize the activity, authorize the new IP address from the email or from the Authorized IPs page. If you don't recognize it, deny it and delete the affected API key immediately, then create a new one. To learn more, check our dedicated article Authorize and block IP addresses for API and SMTP security.
Verify the fix
Go to the Authorized IPs page and confirm the IP address shows the status you expect, either authorized or removed.
If you keep receiving alerts for IP addresses you don't recognize after replacing your API key, contact our support team.
⏭️ What's next?
- Create and manage your API keys
- About API key permissions
- My account has been compromised, what should I do?
🤔 Have a question?
If you have a question, feel free to contact our support team by creating a ticket from your account. If you don't have an account yet, you can contact us here.
If you’re looking for help with a project using Brevo, we can match you with the right certified Brevo Agency partner.