Email API

Transactional email API for applications in Bangladesh.

The EmailDesk email API gives applications in Bangladesh a structured server-to-server sending path without exposing a mailbox password. API credentials remain customer-scoped, sender identities and domain readiness are checked, and each request passes bounded input, quota, and outbound-protection controls before provider handoff.

Start your free trial

What EmailDesk provides

Build transactional email on a controlled interface.

Transactional application use cases

Send account notices, billing updates, receipts, password flows, CRM notifications, SaaS events, and other requested operational messages.

Scoped API credentials

Create a credential for WordPress, Laravel, SaaS, CRM, billing, or an application without sharing a mailbox login. Domain or exact-address restrictions narrow its sender scope.

Sender and domain verification

The exact From address must be verified and permitted by the credential. The sender domain must satisfy the active gateway's SPF requirement and should publish aligned DKIM and DMARC.

Recipient and attachment limits

One request supports up to 100 total To, Cc, and Bcc recipients and 10 Base64 attachments, limited to 10 MB each and 20 MB combined.

Retry-aware quota behavior

Quota is tied to submitted recipient and attachment units. A direct API resubmission is a new send, so applications should prevent duplicate retries with their own stable event or job record.

Delivery and provider evidence

EmailDesk records the source, selected profile, validation and policy result, immediate provider response, quota use, and later outcome evidence when available.

How to begin

Connect an application in four bounded steps.

The integration begins with domain and sender readiness. A valid key cannot override an unverified sender, missing gateway authorization, request limit, quota decision, or outbound policy result.

01
Prepare the sender
Assign the sending domain, verify the exact From email, authorize the active gateway in SPF, and publish the applicable DKIM and DMARC records.
02
Create and store the API key
Generate a restricted credential, copy the one-time secret into a protected server-side environment, and never place it in browser code, source control, screenshots, or logs.
03
Submit a bounded request
Post a small transactional JSON request with the verified From address, recipients, subject, and text or HTML body. Add Base64 attachments only when required.
04
Inspect evidence before retrying
Review the API response and Outbound History before retrying an uncertain result. Use a stable application event or job record to prevent duplicate direct API submissions.

Safe request example

Start with a server-side request.

This example uses reserved example domains and a placeholder credential. Replace them only inside a protected server environment after the sender is verified.

Keep the credential server-side. Do not paste a production key into public code, a browser request, a support message, source control, or analytics.

Example cURL request

curl --request POST 'https://app.emaildesk.bd/api/v1/send' \
  --header 'Authorization: Bearer YOUR_EMAILDESK_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "fromEmail": "notifications@example.com",
    "to": ["customer@example.net"],
    "subject": "Your account update",
    "body": "Your requested account update is ready."
  }'

Operational evidence

Keep application sends explainable.

An API integration should make failures easier to diagnose. EmailDesk separates request validation, sender readiness, protection and quota decisions, provider handoff, and later recipient evidence. Provider acceptance is not a guarantee of final inbox delivery.

Credential, source integration, and permitted sender scope.
Verified From identity plus the selected gateway's sender-domain requirement.
Recipient, attachment, body-size, credential, and workspace limit results.
Outbound-protection decision and safe reason when a request is blocked or held.
Immediate provider response kept separate from later rejection, bounce, or complaint evidence.
Recipient-unit quota plus applicable attachment-unit accounting.

Frequently asked questions

Questions about the EmailDesk API.

What can I send through the transactional email API?

Typical uses include SaaS account events, CRM notifications, billing notices, receipts, password flows, WordPress and Laravel messages, and other requested operational application email. The acceptable-use policy and outbound-protection checks still apply.

Can one API key send from any address?

No. The sender must be verified for the customer and allowed by the API credential. The domain must also satisfy the active gateway's authentication requirements.

What are the request limits?

A request can contain up to 100 total To, Cc, and Bcc recipients and 10 attachments. Each decoded attachment can be up to 10 MB, combined attachments can be up to 20 MB, and the complete HTTP request can be up to 30 MB.

How should an application retry safely?

Do not blindly resubmit after an uncertain response. Record a stable event or job ID in the application, check the API response and Outbound History, and submit again only when the application has determined that a new send is required. A direct API resubmission is treated as a new send and quota event.

Does a provider response guarantee inbox delivery?

No. An accepted or queued provider response records the handoff at that stage. Recipient filtering, rejection, delay, or a later bounce can still change the outcome.

How should I protect the API key?

Store it only in a protected server-side secret or environment setting. Do not expose it in browser JavaScript, mobile application code, source control, screenshots, support messages, or analytics.

Free guided trial

Review EmailDesk against your real email workflow.

Submit a short trial request. No package choice, card, or online payment is required before the request is reviewed.