Register once
Each project gets a matching @atbas.xyz sender, a Stalwart mailbox, and a revocable send-only token from the admin panel.
Transactional email
Resend compatible
Transactional email for atbas.xyz projects
One HTTPS endpoint to send a login OTP or a sanitised generic message. Each project gets a sender identity, a mailbox and a revocable token.
This service delivers mail. It does not generate, store or verify OTP codes — each project owns its own auth logic and passes the code in.
Send
POST /v1/send
Bearer $EMAIL_API_TOKEN
Why it exists
One sender for every atbas.xyz app
Stop embedding provider credentials and reinventing templates, rate limiting and auditing.
Send now or fail now
Outbound SMTP is blocked on ports 25, 465 and 587. The HTTPS API is the only path that works — and the right one for an OTP.
Shared discipline
Named templates, sanitised generic mail, per-project quotas and a send log live here so every project does not build them again.
Admin panel
What the admin panel covers
Register senders, inspect every attempt, preview templates and watch the shared allowance. Volume and tokens stay behind /admin.
Projects
Register a sender, mint or revoke tokens, restrict callers by IP, set the daily quota, and create or retry the matching mailbox.
Send log
Every attempt, including refusals. Per-attempt drawer, masked addresses, and a CSV export.
Templates
Live preview of named templates and a real test send against a chosen project.
Health
Shared monthly allowance, this-service volume, and last-24h deliverability.
How to send
POST /v1/send
Authenticate with a send-only token that looks like es_…. A 202 Accepted response is { "id" } plus a provider delivery id. GET /v1/templates lists named templates.
{
"type": "template",
"to": "user@example.com",
"template": "otp",
"variables": {
"code": "482913",
"expiresInMinutes": 10,
"appName": "Your App"
}
}
{
"type": "generic",
"to": "user@example.com",
"subject": "Welcome aboard",
"html": "<p>Hello</p>",
"text": "Hello"
}
curl -X POST https://mail-api.atbas.xyz/v1/send \
-H "Authorization: Bearer $EMAIL_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"type":"template","to":"user@example.com","template":"otp","variables":{"code":"482913","expiresInMinutes":10,"appName":"Your App"}}'
Scope
What it does not do
No inbox access
It can create the matching mailbox. It does not read or store inbox contents.
Not an auth provider
It does not generate, store or verify OTP codes.
Send-only tokens
Deliberately not Stalwart app passwords, which also grant IMAP read access.
Guardrails
Limits
Documented defaults. One shared monthly allowance across every project.
100
per project / day
Delivered messages. Resets 00:00 UTC.
100
per token / hour
Burst guard, independent of the daily quota.
5
per recipient
Across all projects, every 10 minutes.
60
per source IP
Per minute, before the token is read.
1
shared plan
Monthly ceiling for the whole service. Resend compatible.