Transactional email API
A transactional email API you can ship in ten minutes
In short
Sendpository sends password resets, receipts, sign-in links and notifications with one HTTPS request. Verify your domain with DNS, create an API key, POST to /v1/emails - and every message gets a delivery log, webhook events and automatic bounce suppression.One request per email
JSON over HTTPS with a Bearer key. A typed Node.js SDK if you want one, plain fetch or curl if you don't.
Safe retries
Send an Idempotency-Key and a retried request returns the original message instead of sending twice.
Scheduling built in
Pass scheduled_at and the message goes out at that time; cancel it any time before.
Batches
Up to 100 messages in one request, each accepted or rejected on its own.
Example
curl -X POST https://api.sendpository.com/v1/emails \
-H "Authorization: Bearer $SENDPOSITORY_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"from": "Your App <hello@mail.yourdomain.com>",
"to": ["customer@example.com"],
"subject": "Reset your password",
"html": "<p>Click to reset.</p>"
}'What happens to a message after you POST it
The call returns as soon as the message is accepted, with an id. Acceptance is not delivery - it means the request was valid, your key was good, your quota allowed it and the recipient was not on your suppression list. Everything after that is asynchronous, and the id is how you follow it.
The message is then signed with your domain's DKIM key and handed to the sending infrastructure, which handles the SMTP conversation with the recipient's mail server, including retries when that server is temporarily unavailable. A transient failure there is not a bounce; it is a queued retry, and it can take hours to resolve either way.
Each transition - delivered, bounced, complained - is written to the delivery log and posted to any webhook endpoint you have configured. If you never configure one, the log still has everything; the webhook exists so your application can react without polling.
Why idempotency matters more than it looks
The dangerous failure in a send API is not an error, it is a timeout. Your request succeeded, the response never arrived, and your retry logic cannot tell that apart from a request that never landed. Without protection the user gets two password-reset emails and two valid tokens.
Pass an `Idempotency-Key` header - any stable string you derive from the event, not a random one - and a repeat of the same key returns the original message instead of sending again. Derive it from something that identifies the attempt, like the row id plus the action, so a genuine second send later gets its own key.
What it does not do
- Acceptance is not delivery. A 200 means the message was queued, and anything that treats it as proof of inbox placement will be wrong a few times a day at volume.
- The API will not send from a domain you have not verified. There is no override - an unverified `from` is refused at the request, which is the behaviour that stops a leaked key being used to spoof someone else.
- Suppressed addresses are refused rather than silently dropped, so you can see it happened.
Questions
What is a transactional email API?
An API your application calls to send one-to-one emails triggered by a user action - password resets, receipts, verification codes - as opposed to bulk newsletters. It handles signing, delivery, retries and bounce tracking so your code only makes an HTTPS request.
How fast is delivery?
Messages are handed to the recipient's mail server within seconds of the API call. The delivery log shows every attempt with a timestamp.
Other features
Inbound email API
Sendpository receives email for addresses on your own domain - support@, replies@, or a catch-all - and delivers each message to your inbox, the API and an email.received webhook.
Email webhooks
Sendpository posts a signed JSON webhook when an email is sent, delivered, delayed, bounced, complained about, opened, clicked or received.
Domain authentication (DKIM, SPF, DMARC)
Sendpository generates a 2048-bit DKIM key for every domain, signed as your own domain so it passes strict DMARC alignment, and puts its SPF and bounce records on a dedicated subdomain so your existing company email is never touched.
Scheduled email
Add scheduled_at with an ISO 8601 time to any send and Sendpository delivers it then.
Send your first email in minutes
6,000 emails a month (up to 200 a day), free forever. No card needed.