Documentation

Sending in five minutes

Add a domain, grab an API key, and send. REST or SMTP, the same signed, tracked, audited pipeline either way.

Get started

Your domain Issued on setup

TXT _bookmyspot a one-time token proves you own the domain
TXT s1._domainkey your DKIM public key every message signed as you
TXT @ a single SPF include one lookup, never a raw IP
CNAME em your return path bounces come back here, attributed
CNAME link your tracking host links stay on your own domain

Not one of these is an IP address. SPF is an include and the rest point at hostnames, so when a sending IP is replaced we change our zone and your records never move. The exact values appear in your dashboard when you add the domain.

Create an account, free, no card. You get 500 emails to start.
Add a domain, we generate the exact DNS records to publish.
Verify, we check your authoritative nameservers directly.
Create an API key, or an SMTP credential, and send.

Authentication

Every API request carries a bearer token. Keep keys server-side; they grant full send rights.

Authorization header

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxx

Send a message

POST /v1/messages

curl -X POST https://api.itsbingmybusiness.com/v1/messages \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "hello@send.yourbrand.com",
    "to": ["customer@example.com"],
    "subject": "Your receipt",
    "text": "Thanks for your order.",
    "html": "<p>Thanks for your order.</p>"
  }'

Returns 202 Accepted with a message id you can trace through the dashboard and webhooks. Pass an Idempotency-Key so a retry never sends twice.

SMTP relay

Point any system that speaks SMTP at our relay. The host, and a credential scoped to one sending domain, are issued together in the dashboard.

connection settings

host:     (issued with your SMTP credential)
ports:    587 (STARTTLS) · 465 (implicit TLS) · 2525 (fallback)
username: (from the dashboard)
password: (shown once when created)

Use 587 unless your host blocks it; 2525 behaves identically and exists to route around that block. Every message is DKIM-signed with your domain's own key whichever port it arrives on.

Webhooks

We POST delivery events as they happen. Verify the HMAC signature over the raw body before trusting a payload.

verify.js

const expected = crypto
  .createHmac('sha256', secret)
  .update(req.rawBody)
  .digest('hex')

if (expected === req.headers['x-bookmyspot-signature']) {
  const { type, recipient } = req.body
  // delivered | bounced | opened | clicked | complained
}

Errors

Errors are JSON with a stable code and a human detail. Common ones:

`domain_not_verified`	The from-domain hasn’t passed DNS verification.
`free_allowance_exhausted`	Your 500 free emails are used up, upgrade to continue.
`rate_limited`	Over your plan’s hourly limit. Retry after the given seconds.
`invalid_from`	The from address isn’t a valid mailbox.

Ready to send?

Get your API key Ask a question