Plug email into
your product.

01 · QUICKSTART

First email in three steps

See the official Resend setup guides for Node.js and Python, then use the SendPlug base URL shown below.

npm install resend
export SENDPLUG_BASE_URL="https://sendplug.nirmaker.com"

import { Resend } from "resend";

const resend = new Resend(process.env.SENDPLUG_API_TOKEN, {
  baseUrl: process.env.SENDPLUG_BASE_URL
});
const { data, error } = await resend.emails.send({
  from: "[email protected]",
  to: ["[email protected]"],
  subject: "Welcome",
  text: "Your account is ready."
});
if (error) throw error;
console.log(data.id);

pip install resend
export RESEND_API_KEY="$SENDPLUG_API_TOKEN"
export RESEND_API_URL="$SENDPLUG_BASE_URL"

import resend
result = resend.Emails.send({
    "from": "[email protected]",
    "to": ["[email protected]"],
    "subject": "Welcome",
    "text": "Your account is ready.",
})

02 · RESEND SUBSET

Compatible where it counts

POST /emails returns { "id": "…" } for official SDK send calls. It accepts from, to, cc, bcc, subject, text, and html. At least one of text or html is required.

to is exactly one address. Address strings may include a display name, but SendPlug ignores the display name and uses the configured sender identity. cc and bcc allow up to 10 each. The from address must match the token-bound Gmail sender and never selects credentials.

03 · AUTHENTICATION

One token, one sender

Every request uses an API token in the HTTP Authorization header.

Authorization: Bearer $SENDPLUG_API_TOKEN

A token is bound to the Google sender selected when it was created. A token cannot send through another sender or read another sender's delivery records.

Scopes

04 · NATIVE API

Queue application email

POST /api/v1/send validates the request, selects the sender from the token, creates a status record, and returns immediately with HTTP 202 Accepted.

Accepted response

{
  "status": "queued",
  "message_id": "5f…@sendplug",
  "sender_id": "sender_…"
}

JavaScript example

const response = await fetch(
  `${process.env.SENDPLUG_BASE_URL}/api/v1/send`,
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.SENDPLUG_API_TOKEN}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      to: ["[email protected]"],
      subject: "Welcome",
      body: "Your account is ready."
    })
  }
);

if (!response.ok) throw new Error(`Send failed: ${response.status}`);
const queued = await response.json();

05 · STATUS

Read delivery state

Use the message_id from the send response. The token needs the status scope and must belong to the same sender.

curl "$SENDPLUG_BASE_URL/api/v1/emails/$MESSAGE_ID" \
  -H "Authorization: Bearer $SENDPLUG_API_TOKEN"

{
  "status": "sent",
  "message_id": "5f…@sendplug",
  "to": ["[email protected]"],
  "subject": "Welcome",
  "sender_id": "sender_…",
  "created_at": "2026-07-23T10:00:00+00:00",
  "updated_at": "2026-07-23T10:00:02+00:00",
  "error": null,
  "details": {
    "recipients": ["[email protected]"],
    "sender_id": "sender_…",
    "subject": "Welcome",
    "sent_at": "2026-07-23T10:00:02+00:00"
  }
}

06 · LIMITS

Safety before volume

The default sender safety limit is 400 recipients per UTC day. The administrator can configure another limit, while Gmail and Google Workspace enforce their own independent limits.

• Every to, cc, and bcc recipient counts toward the sender's daily limit.
• Quota is reserved atomically by the worker to prevent concurrent jobs from oversending.
• The default HTTP burst is 10 sends per API token per 60 seconds. A 429 response includes Retry-After. This counter is process-local for the single-VM MVP.
• A request can queue and later become failed if no daily quota remains. Read the status record's error.
• Transient Gmail/network delivery failures retry automatically with backoff; permanent failures do not.

Status records expire 7 days after their last status update. Persist any application-level audit information you need beyond that window.

07 · ERRORS

HTTP errors

{ "detail": "Invalid or revoked API token" }

08 · SECURITY

Production checklist

• Call SendPlug from your backend, server action, worker, or trusted function.
• Never embed API tokens in browser JavaScript, mobile binaries, URLs, or analytics events.
• Grant only the scopes each application needs.
• Rotate with overlap: create a new same-sender key, deploy it, verify last_used_at, then revoke the old key.
• App Passwords reach SendPlug over HTTPS and are encrypted before database storage; this is not end-to-end encryption.
• Do not send cold outreach or email people who did not request it.