Send Framer mail through SecureSMTP
Send Framer form submissions to a webhook in Make, Zapier or n8n, which then calls our API. Framer cannot add the API key header itself.
Setup
Framer sends to SecureSMTP with an HTTPS request to our API, either directly or through an automation tool.
- 1
Create a SecureSMTP account
Sign up at securessmtp.com/signup. The Free plan includes 5,000 emails a month. No card needed.
- 2
Add a site and copy its API key
Dashboard → Forms → Sites → + Add Site. The last step shows the site’s API key (it starts with qcs_live_). It is shown only once, so copy it. The API keys page (/app/forms/api-keys) also shows the SMTP settings.
- 3
Connect Framer
Select the form → Send To → Add… → Webhook, and paste a webhook URL from Make, Zapier or n8n. Framer sends the fields as JSON but cannot add our key header, so the automation makes the call: POST https://securessmtp.com/api/v1/mail/send with the header x-securessmtp-api-key.
- 4
Build the request
POST https://securessmtp.com/api/v1/mail/send with the header x-securessmtp-api-key: <your site API key> and a JSON body: to, subject, html or text, and optionally reply_to, cc, bcc and from: { name }. from must be an object; SecureSMTP sets the From address. Use the JSON below as a starting point. To also store the submission and run the form spam check in SecureSMTP, POST to /api/v1/forms/submit instead, with { form_id, form_name, fields: { ... } } and the same header.
- 5
Send from your own domain
New accounts send only from their own verified domain. Add a sending domain (any plan, including Free) and publish its DKIM record. Until it is verified you can send test emails to yourself. See securessmtp.com/docs/guides/domains-and-dns.
- 6
Send a test
Run the workflow once. Every response has an ok field: HTTP 200 with ok: false means the email was not sent, and reason says why. The email shows up in the Email log in your dashboard.
POST https://securessmtp.com/api/v1/mail/send
x-securessmtp-api-key: <your-site-api-key>
Content-Type: application/json
{
"to": "[email protected]",
"subject": "New submission from {{name}}",
"text": "{{message}}",
"reply_to": "{{email}}",
"from": { "name": "Your Site" }
}
// {{...}} = values mapped from the trigger.
// The response always has "ok". HTTP 200 with "ok": false = not sent.What you get
DKIM-signed email
Every email is signed with DKIM. With a verified sending domain it is signed as your domain, so DMARC passes for your domain.
Spam check before sending
Each email goes through a content check and an AI spam check before it leaves, so junk form posts do not go out under your name.
Email log and events
Every email is in the dashboard Email log with its status. Delivered, bounced, opened and clicked events can be posted to your server by webhook.
Retries on temporary errors
If the receiving server asks us to try again later, we keep trying and send an email.delayed event.
FAQ
How long does setup take?
A direct HTTP call takes a few minutes. If Framer needs an automation tool in between, add the time to build that workflow. New accounts also add their sending domain and publish one DNS record, because they send only from their own verified domain.
Which From address will people see?
New accounts send from their own verified sending domain, so mail goes out from the address you set for that domain. Any plan, including Free, can add one. Until it is verified you can send test emails to yourself. Older accounts can keep using [email protected] for a limited time, with your sender name, and the original From address becomes the Reply-To.
What happens if SecureSMTP cannot be reached?
The API call or SMTP login fails and the platform or automation tool shows the error; most automation tools can retry a failed step. Once we accept an email, we keep retrying if the receiving server asks us to try again later.
Can I send from my own domain?
Yes, and new accounts need to. Any plan can add a sending domain (Free includes 1). Add it in the dashboard and publish one DKIM TXT record (the advanced setup adds two more records). Emails sent from a verified domain do not count toward the monthly limit.