Surface Brevo API auth errors and avoid SMTP fallback on 401/403

server.js

@@ -64,22 +64,25 @@ async function sendViaBrevoApi(message) {
         htmlContent: message.html
     };
 
-    await axios.post(
-        'https://api.brevo.com/v3/smtp/email',
-        payload,
-        {
-            headers: {
-                'api-key': apiKey,
-                accept: 'application/json',
-                'content-type': 'application/json'
-            },
-            timeout: BREVO_API_TIMEOUT
-        }
-    );
+    await axios.post('https://api.brevo.com/v3/smtp/email', payload, {
+        headers: {
+            'api-key': apiKey,
+            accept: 'application/json',
+            'content-type': 'application/json'
+        },
+        timeout: BREVO_API_TIMEOUT
+    });
 
     console.log('Email sent via Brevo API');
 }
 
+function describeBrevoError(err) {
+    const status = err?.response?.status;
+    const dataMsg = err?.response?.data?.message || err?.response?.data?.error || '';
+    const text = err?.message || String(err);
+    return { status, detail: dataMsg || text };
+}
+
 function getEmailTransport() {
     if (emailTransport || emailConfigChecked) return emailTransport;
 
@@ -165,7 +168,12 @@ async function sendEmail(message) {
             await sendViaBrevoApi(message);
             return;
         } catch (err) {
-            console.error('Brevo API send failed, falling back to SMTP if available:', err && err.message ? err.message : err);
+            const info = describeBrevoError(err);
+            // If auth error, do not fallback to SMTP (likely wrong key) — surface error early
+            if (info.status === 401 || info.status === 403) {
+                throw new Error(`Brevo API auth error (${info.status}): ${info.detail}`);
+            }
+            console.error('Brevo API send failed, falling back to SMTP if available:', info.detail || err);
         }
     }