Quickstart
Use server-side API credentials to authenticate requests. API keys must not be embedded in browser code, client-side bundles, public repositories, or mobile applications.
import { Sendout } from 'sendout';
const client = new Sendout('so_xxxxxxxxx');
await client.emails.send({
from: 'notifications@yourdomain.com',
to: 'user@example.com',
subject: 'Verify your email',
html: '<p>Confirm your email address.</p>'
});Domain verification
Production sending from a custom domain requires proof of domain control through DNS. Sender authentication should include DKIM and SPF, with DMARC strongly recommended.
Send email
POST /v1/emails
Authorization: Bearer so_xxxxxxxxx
Content-Type: application/json
{
"from":"notifications@yourdomain.com",
"to":"user@example.com",
"subject":"Your account notification",
"html":"<p>This is an expected application message.</p>"
}Delivery events
Delivery lifecycle events can include delivery, bounce, complaint, reject, open, and click signals, depending on configuration and recipient-provider behavior.
SMTP
Applications that rely on SMTP can use dedicated credentials. SMTP secrets must be protected and rotated if exposure is suspected.
Suppression
Hard bounces and complaints are treated as suppression events. Customers must not attempt to circumvent suppression or repeatedly resend to recipients who have complained or are known to be invalid.
Security
Keep credentials server-side, use TLS, implement least privilege, rotate compromised credentials, and report suspected abuse or security issues to support@sendout.com.br.