Brevo API Key Stopped Working? The 90-Day Inactivity Rule and Fixes

Brevo deactivates any API key that hasn't made a successful call in 90 days, even when its expiry is set to "no expiration". To fix a key that already stopped, reactivate it in Settings > SMTP & API > API Keys & MCP and make one test call. To stop it happening again, make sure the key makes a successful call at least once every 90 days. SMTP keys work the same way, counted in successful emails sent.

A recent r/Emailmarketing thread (14 comments) came from someone who wires Brevo into contact forms on small client sites. A form that gets two submissions a quarter goes quiet for 90 days, the key is switched off, and the next lead's confirmation email never goes out. The poster was considering leaving Brevo over it. Before you do, here's what Brevo's help center says (articles updated between 16 October and 2 November 2026) and the cheaper fixes.

The rule, in Brevo's words

From Create and manage your API keys:

• "Even with no expiration date, a key is deactivated if it hasn't made a successful API call in 90 days. You'll receive an email reminder 7 days before and on the day this happens."
• Keys you give a fixed expiry (7 days to 1 year) also get a reminder 3 days before and on the day.

From Create and manage your SMTP keys: "even with no expiration date set, the key is deactivated if it hasn't sent a successful email in 90 days." Brevo's own advice is to send "at least one email through the key every 90 days".

The troubleshooting article adds a common trap: if you get an inactivity warning for a key you think is busy, your integration may be using a different key. Compare the last digits shown on the API Keys & MCP page with the key in your site's config.

Fix a key that already stopped

1. Open Settings > SMTP & API > API Keys & MCP.
2. Find the key by name and last digits. Status shows active, deactivated or read-only.
3. Click the three dots and choose Activate API key. For an SMTP key: the SMTP tab, select the key, Activate SMTP key.
4. Submit your own form, or make one test call, then check Last used on shows today.

If the status is read-only, Brevo locked it after detecting a compromise, and it can't be reactivated. Create a new key, update the site, and read Brevo's compromised-account guidance.

While the key was off, form submissions may have failed silently. Check your form plugin's or site's error log for the gap and contact anyone who signed up in that window.

Keep a quiet site's key alive

Pick one, per key:

• A scheduled read-only call. A cron job, uptime monitor or scheduled function that calls a harmless read endpoint every two to four weeks. Give it a Restricted key with read access to one resource, so a leaked keep-alive key can't send mail or export contacts. Note that Brevo's articles say "successful API call" but don't name which endpoints count. After the first run, check that Last used on has moved.
• A scheduled test email for SMTP keys, sent to an inbox you own. That matches Brevo's own advice and also tells you the form still delivers.
• A fixed expiry you track. If you'd rather rotate keys deliberately, set a 6- or 12-month expiry and put the date in your calendar. The 90-day inactivity rule still applies, so you still need some traffic.

Two other things to check while you're there:

• Who gets the reminder emails. They go to the account, which on client sites is often a dead inbox. Forward them to whoever maintains the site.
• Unknown-IP blocking. If it's on and your host changes IP, Brevo emails you to confirm the new IP before it accepts calls from it. A host migration can look like an expired key.

If you still want to switch

The poster wanted free use at low volume, API keys for forms, and several client accounts. Published limits we could read on 2 November 2026:

Provider	Free plan	Cheapest paid plan
Resend	3,000 emails a month, 100 a day, 3 domains	$20 a month for 50,000
Postmark	100 emails a month	$15 a month for 10,000, then $1.80 per 1,000
Amazon SES	See AWS's page	$0.10 per 1,000 emails

Brevo's pricing page didn't show its free-plan numbers to our fetcher, so it isn't in the table. Read each provider's key and inactivity policy in its docs before you move. Pricing pages rarely mention it, and moving ten client sites costs more than one keep-alive job.

Keep the form's list clean while you're in there

A contact form that sends confirmation emails is also a way in for typos, disposable addresses and bots. Bounces from those count against the same account. Check addresses at signup (verifying on signup in Next.js shows the pattern, and signup protection has recipes for other stacks), and clean the list you already have before your next campaign with our Brevo list cleaning guide or the free Brevo contacts to email list tool.

Where SimpleVerifier fits

SimpleVerifier doesn't send email, so it doesn't replace Brevo. It checks the addresses before Brevo mails them. The first 100 checks are free with a Google sign-in on the verify page. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off, and one-time packs of 10,000 checks for $15 never expire. API access for form checks comes with Pro. See pricing.