Send email from your code, the way you already do.

Use one key per system and per environment. The checkout, WordPress or the ERP only need to send: give them a send-only key, tied to the right domain.

• If a send-only key leaks, it can only send and see what it sent itself
• The key is shown only once, at creation
• Send-only keys tied to a domain depend on the plan

All paths go through the same rules: verified domain, quotas, suppression list and the same events. Choose where to send from.

curl -X POST https://api.postal.so/emails \
  -H "Authorization: Bearer $POSTAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "Aurora Cosméticos <[email protected]>",
    "to": ["[email protected]"],
    "subject": "Your order #10482 is out for delivery",
    "html": "<p>Order <b>#10482</b> is on its way.</p>"
  }'

import { Postal } from 'postal-so';

const postal = new Postal(); // reads POSTAL_API_KEY

const { id } = await postal.emails.send(
  {
    from: 'Aurora Cosméticos <[email protected]>',
    to: '[email protected]',
    subject: 'Your order #10482 is out for delivery',
    html: '<p>Order <b>#10482</b> is on its way.</p>',
  },
  { idempotencyKey: 'order-10482-shipped' },
);

use Postal\Client;

$postal = new Client(); // reads POSTAL_API_KEY

$result = $postal->emails->send([
    'from' => 'Aurora Cosméticos <[email protected]>',
    'to' => '[email protected]',
    'subject' => 'Your order #10482 is out for delivery',
    'html' => '<p>Order <b>#10482</b> is on its way.</p>',
], 'order-10482-shipped'); // idempotency key

echo $result['id'];

Server     smtp.postal.so
Port       465 (direct TLS) or 587 (STARTTLS)
User       postal
Password   an API key (ps_...)

# Laravel, in .env
MAIL_MAILER=smtp
MAIL_SCHEME=smtps
MAIL_HOST=smtp.postal.so
MAIL_PORT=465
MAIL_USERNAME=postal
MAIL_PASSWORD=ps_your_key

Every request made with an API key and every message sent over SMTP appears under Logs, with the body sent and the response. Logs are kept for 30 days.

Receive every email event on your server, with a Standard Webhooks signature, up to 8 attempts and manual resend. The SDK verifies the signature in one line.

• 30 event types, from emails to contacts and inboxes
• Same webhook-id on every attempt, so you can discard duplicates
• Test event and test addresses, such as [email protected]

import express from 'express';
import {
  verifyWebhook,
  PostalWebhookVerificationError,
} from 'postal-so';

const app = express();

// The body must arrive raw (Buffer)
app.post(
  '/webhooks/postal',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    try {
      const event = verifyWebhook(
        req.body,
        req.headers,
        process.env.POSTAL_WEBHOOK_SECRET,
      );
      if (event.type === 'email.bounced') {
        // remove the address
      }
      res.sendStatus(200);
    } catch (error) {
      if (error instanceof
          PostalWebhookVerificationError) {
        return res.sendStatus(400);
      }
      throw error;
    }
  },
);

See the webhooks page

Test addresses generate real events and webhooks, don't use the quota and don't affect your reputation. They depend on the plan. The CLI helps you test from the terminal, with JSON output for scripts.

npm install --global postal-so
postal login
postal emails send \
  --from [email protected] \
  --to [email protected] \
  --subject "Teste" --text "Funcionou"

Postal's API uses the same features, field names and response formats, so migrating usually means swapping the base URL and the key. The Resend SDK keeps working if you point the base URL to Postal.

• Tested with the resend 6.34 package for Node.js
• What changes: the secret and signing rules for webhooks, limits and quotas

- curl -X POST https://api.resend.com/emails \-   -H "Authorization: Bearer re_..."- - # ou, com o SDK da Resend, no .env- RESEND_BASE_URL=https://api.resend.com+ curl -X POST https://api.postal.so/emails \+   -H "Authorization: Bearer ps_..."+ + # ou, com o SDK da Resend, no .env+ RESEND_BASE_URL=https://api.postal.so

Read the migration guide

The OTP-Token header carries the code and the originating site. It is still an IETF draft and not every email client reads it; those that don't know it ignore it.

From: Aurora Cosméticos <[email protected]>
Subject: Your access code
OTP-Token: "123456"; origin="https://app.exemplo.com.br"