Configure authentication to SendGrid

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for SendGrid from the Previews page. See Manage Databricks previews.

This page shows how to configure SendGrid to enable authentication from Databricks for the SendGrid connector. The SendGrid connector uses a SendGrid API key to ingest data into Databricks. Use the credentials retrieved from the steps on this page to create a Unity Catalog connection in Databricks.

Prerequisites

• A SendGrid account on a Pro or Premier email API plan, or an Advanced Marketing Campaigns plan. Subusers are available only on these plans. For more information, see Subusers in the SendGrid documentation.
• Administrator access to create an API key with read access to the Subusers, IP Access Management, Suppressions, Unsubscribe Groups, Marketing, and Template data.
• To ingest the contacts, lists, segments, singlesends, singlesend_stats, and automations_stats tables, a SendGrid account with Marketing Campaigns enabled.
• If your account has IP Access Management enabled, the Databricks serverless egress IP addresses must be on your allowlist. SendGrid blocks API access from IP addresses that are not on the list.

Configure SendGrid

Create a SendGrid API key with read access to the APIs for the tables you want to ingest. For more information, see API keys in the SendGrid documentation.

1. Sign in to the SendGrid application as an administrator.

2. In the left navigation, select Settings > API Keys.

3. Click Create API Key.

4. Enter a name for the key, then select Custom Access.

5. Grant read access to the following permissions, according to the tables you want to ingest. For the API key scope that each permission maps to, see API key permissions in the SendGrid documentation.

   Permission	API key scope	Tables
   IP Access Management	Read access	recent_access_attempts, parent_access_attempts
   Subusers	Read access	subusers, recent_access_attempts
   Suppressions	suppression.read	bounces, spam_reports, global_suppressions, blocks, invalid_emails
   Unsubscribe Groups	asm.groups.read	suppression_groups, suppression_group_members
   Marketing	marketing.read	contacts, lists, segments, singlesends, singlesend_stats, automations_stats
   Templates	templates.read	templates

   Permission	API key scope	Tables
   IP Access Management	Read access	recent_access_attempts, parent_access_attempts
   Subusers	Read access	subusers, recent_access_attempts
   Suppressions	suppression.read	bounces, spam_reports, global_suppressions, blocks, invalid_emails
   Unsubscribe Groups	asm.groups.read	suppression_groups, suppression_group_members
   Marketing	marketing.read	contacts, lists, segments, singlesends, singlesend_stats, automations_stats
   Templates	templates.read	templates

   Keep each permission category expanded while you make selections. Collapsing a category can reset its selections.

6. Click Create & View, then copy the generated key. SendGrid shows the key value only once.

7. Store the key securely. You enter this value as the API Key when you create a connection in Databricks. Enter only the key value, without a Bearer prefix.

Note the data region of your SendGrid account. EU data-residency accounts use api.eu.sendgrid.com; all other accounts use the global endpoint api.sendgrid.com. You select this region when you create the connection. The Marketing Campaigns tables (contacts, lists, segments, singlesends, singlesend_stats, and automations_stats) are available only for US-region accounts. Don't select them on a connection that uses the eu region.

The API key reads data only for the account it belongs to. To ingest from more than one SendGrid account or subuser, create a separate API key and connection for each.

Next steps

Create a SendGrid connection in Databricks. See Create a SendGrid connection.