INTEGRATIONS · Published 2026-10-06 · Updated 2026-10-06 · SecureSMTP
PHP
A send function with cURL.
Call the API with PHP’s cURL extension — there is no SecureSMTP package to install. Or send over SMTP with PHPMailer. On WordPress, use the WordPress plugin instead.
Setup
Every request needs your site’s API key. Get it when you add the site under Sites (/app/forms/sites) in the dashboard — see Sites and API keys. Keep it in an environment variable on the server:
Shell
export SECURESSMTP_API_KEY="qcs_live_..."Never put the key in browser JavaScript, a mobile app or a public repository. Anyone who has it can send email as your site.
A send function
securessmtp.php
<?php
// securessmtp.php (PHP 8.0 or later, needs the curl extension)
function securessmtp_send(array $message): array
{
$ch = curl_init('https://securessmtp.com/api/v1/mail/send');
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'x-securessmtp-api-key: ' . getenv('SECURESSMTP_API_KEY'),
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => json_encode($message, JSON_THROW_ON_ERROR),
CURLOPT_TIMEOUT => 30,
]);
$body = curl_exec($ch);
if ($body === false) {
throw new RuntimeException('SecureSMTP: ' . curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
$result = json_decode($body, true);
if (!is_array($result) || empty($result['ok'])) {
$reason = $result['reason'] ?? $result['error'] ?? 'request_failed';
throw new RuntimeException("SecureSMTP: $reason (HTTP $status)", $status);
}
return $result; // ['ok' => true, 'sent' => true, 'mode' => ..., 'message_id' => ...]
}Send an email with an attachment:
PHP
<?php
require __DIR__ . '/securessmtp.php';
$result = securessmtp_send([
'to' => '[email protected]',
'subject' => 'Your order has shipped',
'html' => '<p>Your order is on its way.</p>',
'text' => 'Your order is on its way.',
'from' => ['name' => 'Acme Store'],
'reply_to' => '[email protected]',
'attachments' => [[
'filename' => 'invoice-1042.pdf',
'content' => base64_encode(file_get_contents(__DIR__ . '/invoice-1042.pdf')),
'content_type' => 'application/pdf',
]],
]);
echo $result['message_id'];from is an array with a name; a plain string is rejected. Attachments: up to 20 files, 15 MB in total, as base64. Every field is listed in the API reference.
Handle errors
PHP
<?php
try {
securessmtp_send([
'to' => '[email protected]',
'subject' => 'Hello',
'text' => 'Hi there.',
]);
} catch (RuntimeException $e) {
// The message holds the reason, e.g. "SecureSMTP: rate_limited (HTTP 200)".
// getCode() is the HTTP status (0 for a network error).
error_log($e->getMessage());
}| Response | Meaning | What to do |
|---|---|---|
200 ok: true | Accepted for sending. | Nothing. Keep message_id if you want to find the email later. |
200 rate_limited | More than 120 sends from this site in 60 seconds. | Wait a minute, then try again. |
200 over_quota | The account’s monthly email count is used up (relay mode only). | Wait for the new month, upgrade, or send from a verified domain. |
200 send_failed | The email was not sent. The error field says why. | Read error. Do not retry in a loop. |
400 invalid_payload, no_body, … | The request is wrong. details lists the fields for invalid_payload. | Fix the request. Retrying the same request fails the same way. |
400 content_flagged, ai_flagged | The content was judged to be spam. | Change the content. See Deliverability. |
401 missing_api_key, invalid_api_key | No key was sent, or the key is wrong or was rotated. | Check the environment variable on the server. |
403 site_disabled | The site is disabled. | See Blocks. |
- Check
okin the body, not only the HTTP status. Rate limit, monthly limit and send failures come back with HTTP 200. - There is no idempotency key. If a request times out, the email may already have been sent, and sending it again can deliver it twice.
- Every reason is listed in the error catalogue.
Or send over SMTP with PHPMailer
| Setting | Value |
|---|---|
| Host | smtp.securessmtp.com |
| Port | 587 with STARTTLS, or 465 with SSL/TLS |
| Username | securessmtp |
| Password | Your site’s API key (qcs_live_...) |
PHP
<?php
// composer require phpmailer/phpmailer
use PHPMailer\PHPMailer\Exception;
use PHPMailer\PHPMailer\PHPMailer;
require __DIR__ . '/vendor/autoload.php';
$mail = new PHPMailer(true); // true = throw exceptions
try {
$mail->isSMTP();
$mail->Host = 'smtp.securessmtp.com';
$mail->Port = 587;
$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS; // or ENCRYPTION_SMTPS with port 465
$mail->SMTPAuth = true;
$mail->Username = 'securessmtp';
$mail->Password = getenv('SECURESSMTP_API_KEY');
$mail->CharSet = PHPMailer::CHARSET_UTF8;
$mail->setFrom('[email protected]', 'Acme Store');
$mail->addAddress('[email protected]');
$mail->Subject = 'Your order has shipped';
$mail->isHTML(true);
$mail->Body = '<p>Your order is on its way.</p>';
$mail->AltBody = 'Your order is on its way.';
$mail->addAttachment(__DIR__ . '/invoice-1042.pdf');
$mail->send();
} catch (Exception $e) {
error_log('Email failed: ' . $mail->ErrorInfo);
}In relay mode (no verified domain) the From address is replaced: the email goes out from
[email protected] with your From name, and the From address you set becomes the Reply-To. Verify your domain and the email goes out from your own address. See Domains and DNS.When the server refuses the message, PHPMailer throws and $mail->ErrorInfo holds the SMTP reply:
| SMTP reply | Meaning |
|---|---|
250 | Accepted. |
535 | Login failed: the password is not a valid API key. |
450 4.7.0 | Rate limit: more than 120 sends from this site in 60 seconds. Retry later. |
550 5.7.0 | Monthly email limit reached. |
550 5.7.1 | Rejected as spam, the site is disabled, or every recipient has unsubscribed. |
550 5.1.1 | Every recipient is on the suppression list. |
552 5.3.4 | Attachments are over 15 MB in total. |
4xx 4.3.0 | Temporary failure. Retry later. |
Next
- Laravel: Laravel.
- Every field and response: POST /mail/send.
- SMTP details: SMTP.