Send password resets, receipts, alerts, onboarding messages, and other transactional email through a clear REST API—or connect an existing application through authenticated SMTP. Both paths share verified domains, workspace limits, delivery activity, and sender safeguards.
Create a scoped key in API & SMTP access, submit a verified sender mailbox, recipient, subject, and message body, then receive an identifier for the queued delivery.
Track every API message by identifier or receive signed HTTPS notifications when it is sent, delivered, bounced, complained about, or cannot be confirmed safely.
Connect frameworks, stores, monitoring tools, CRMs, and legacy applications through standard authenticated SMTP without maintaining a second email provider.
Every plan publishes monthly and rolling-hour capacity. Invalid accounts, senders, recipients, and quota states are rejected before a message enters the queue.
Before sending customer traffic, verify DNS, separate production and staging credentials, test failure handling, and use a monitored reply address.
Open the dedicated API reference for authentication scopes, request fields, response codes, attachment limits, delivery states, signature verification, and a downloadable OpenAPI 3.1 document.
Choose your language, copy a complete request, and replace the origin, API key, and mailbox identifier with values from your workspace. Keep API keys on the server—never expose them in browser code or a public repository.
Best for a quick terminal test or for confirming credentials during setup.
curl -X POST https://your-domain.example/api/v1/send \
-H "Authorization: Bearer $SUPERMAILHUB_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"mailboxId": "YOUR_MAILBOX_ID",
"recipient": "customer@example.com",
"subject": "Welcome",
"bodyText": "Your account is ready."
}'Open Workspace → API & SMTP, create a key for the application, and store it in a secret manager or protected environment variable.
Replace YOUR_MAILBOX_ID with a mailbox from a verified domain. The authenticated workspace must be allowed to send from it.
A successful request returns a message identifier for queued delivery. Log that identifier, handle non-2xx responses, and retry only transient failures.
Use monitored reply addresses, honor suppressions, verify SPF, DKIM, and DMARC, and increase new-domain traffic gradually.
Store the id returned by POST /api/v1/send, then query the message with a key containing mail.status.read. Processing status covers the internal send queue; delivery status advances when the receiving provider reports delivery, bounce, or complaint activity.
curl https://your-domain.example/api/v1/messages/MESSAGE_ID \
-H "Authorization: Bearer $SUPERMAILHUB_API_KEY"
# Response
{
"processingStatus": "sent",
"deliveryStatus": "delivered",
"message": { "id": "MESSAGE_ID", "recipient": "customer@example.com" },
"events": [{ "eventType": "delivered", "createdAt": "2026-08-18T12:00:00Z" }]
}Configure one public HTTPS endpoint in Workspace → API & SMTP. Events include message.sent, message.delivered, soft and hard bounces, complaints, failures, and unknown SMTP outcomes. Return any 2xx response promptly; unsuccessful requests are retried up to eight times.
import crypto from 'node:crypto';
const timestamp = request.headers['webhook-timestamp'];
const signature = request.headers['webhook-signature'];
const signed = timestamp + '.' + rawRequestBody;
const expected = 'v1=' + crypto
.createHmac('sha256', process.env.SUPERMAILHUB_WEBHOOK_SECRET)
.update(signed)
.digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
throw new Error('Invalid webhook signature');
}Verify the HMAC-SHA256 signature over Webhook-Timestamp + "." + raw request body. Reject stale timestamps and deduplicate requests with Webhook-Id.