Send cURL / raw HTTP mail through SecureSMTP
One POST to /api/v1/mail/send with the x-securessmtp-api-key header and a JSON body.
Setup
Send from your server with SMTP or one HTTPS request. There is no SDK to install.
- 1
Create a SecureSMTP account
Sign up at securessmtp.com/signup. The Free plan includes 5,000 emails a month. No card needed.
- 2
Add a site and copy its API key
Dashboard → Forms → Sites → + Add Site. The last step shows the site’s API key (it starts with qcs_live_). It is shown only once, so copy it. The API keys page (/app/forms/api-keys) also shows the SMTP settings. Store the key in an environment variable (for example SECURESMTP_API_KEY). Never commit it or send it to the browser.
- 3
What to install
No install needed. Just curl from any shell, Lambda, GitHub Action, or cron job.
- 4
Make your first send
Copy the snippet below into a server-side endpoint or background job. Replace to, subject and the body with your own values.
- 5
Send from your own domain
New accounts send only from their own verified domain. Add a sending domain (any plan, including Free) and publish its DKIM record. Until it is verified you can send test emails to yourself. See securessmtp.com/docs/guides/domains-and-dns.
- 6
Test it
Trigger your endpoint once. With the API, check that the response has ok: true. The email shows up in the Email log in your dashboard.
curl -X POST https://securessmtp.com/api/v1/mail/send \
-H "x-securessmtp-api-key: $SECURESMTP_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"from": { "name": "Your Site" },
"to": "[email protected]",
"subject": "Contact",
"html": "<p>Hello from cURL</p>"
}'What you get
DKIM-signed email
Every email is signed with DKIM. With a verified sending domain it is signed as your domain, so DMARC passes for your domain.
Spam check before sending
Each email goes through a content check and an AI spam check before it leaves, so junk form posts do not go out under your name.
Email log and events
Every email is in the dashboard Email log with its status. Delivered, bounced, opened and clicked events can be posted to your server by webhook.
Retries on temporary errors
If the receiving server asks us to try again later, we keep trying and send an email.delayed event.
FAQ
How long does setup take?
A few minutes: add a site, put the key in an environment variable and add the snippet. New accounts also add their sending domain and publish one DNS record, because they send only from their own verified domain.
Which From address will people see?
New accounts send from their own verified sending domain, so mail goes out from the address you set for that domain. Any plan, including Free, can add one. Until it is verified you can send test emails to yourself. Older accounts can keep using [email protected] for a limited time, with your sender name, and the original From address becomes the Reply-To.
What happens if SecureSMTP cannot be reached?
The API call or SMTP login fails and the platform or automation tool shows the error; most automation tools can retry a failed step. Once we accept an email, we keep retrying if the receiving server asks us to try again later.
Can I send from my own domain?
Yes, and new accounts need to. Any plan can add a sending domain (Free includes 1). Add it in the dashboard and publish one DKIM TXT record (the advanced setup adds two more records). Emails sent from a verified domain do not count toward the monthly limit.