Developers

An email API you won't have to work around.

Scoped keys in a header, idempotent writes, cursor pagination, one error format and signed webhooks you can replay. The boring parts are done properly, so your integration stays boring too.

Request my early access

REST API

Retry anything. Nothing happens twice.

Send an Idempotency-Key on a write and a retry after a timeout returns the original answer instead of creating a second contact or a second email. Keys go in the Authorization header, never in a URL where they end up in logs.

  • Keys scoped to exactly what they may do, stored only as a hash
  • Expiry dates, IP allowlists and rotation with a grace period
  • Cursor pagination on every list
  • Rate limit headers on every response
  • One error shape with a code, a message, field details, a request id and a docs link
  • Resources from another workspace answer 404, never a hint that they exist
An error you can act on
{
  "error": {
    "code": "validation_failed",
    "message": "The request has a validation error.",
    "details": [{
      "path": "/email",
      "code": "invalid",
      "message": "That is not a valid email address."
    }],
    "request_id": "req_…",
    "docs_url": "…/errors/validation_failed"
  }
}
Verify a webhook in PHP
$expected = hash_hmac('sha256',
    $timestamp . '.' . $rawBody, $secret);

foreach (explode(',', $signature) as $entry) {
    if (hash_equals('v1=' . $expected, trim($entry))) {
        return true;
    }
}

Webhooks

Events you can trust, and replay when your server was down.

Every delivery is signed with HMAC-SHA256 and a timestamp. Failed deliveries retry with backoff for about 20 hours, and every attempt sits in a log you can read and replay with one call. A replay keeps the original event id, so your deduplication still works.

  • Contact, consent, message and automation events
  • Bounce, complaint and delivery events straight from SES
  • Secret rotation with two signatures during the overlap

MCP server

Let an AI assistant run your email. It has to ask first.

Connect Claude or any client that speaks the Model Context Protocol. Sign in with HeySender through OAuth, pick a workspace, and the assistant gets only the permissions your own role already has.

1

It looks things up

Search contacts, explain why someone is not receiving email, estimate a segment, check sender health and read usage.

2

It drafts

Create contacts, lists, segments and automation drafts, and test a flow on a real contact. Drafts never go live on their own.

3

It asks before anything real

Publishing, pausing, deleting and bulk changes return a preview first. Only your yes, within five minutes, lets it continue.

AreaReadsDraftsNeeds your confirmation
Contactssearch, get, activity, explain statuscreate, update, add or remove tagdelete, bulk update
Audienceslist, get, estimate, samplecreate list, create or update segment
Automationslist, get, steps, validate, simulate, summarycreate draft, update, duplicatepublish, pause, move contacts, delete
Campaignslist, get, validate, estimate audience, previewcreate draft, update draft, request approvalapprove, schedule, send now, pause, cancel
Formslist, get, submissions, statscreate draft, update draftpublish
Transactionaltemplates, get email, list emailssandbox sendlive send
Templateslist, get, previewduplicate
Deliverabilitysender health, suppression lookup, event summary
Billingplan, usage, invoices, plan change preview

OAuth 2.1

Sign in with HeySender for your own app.

Authorization code with PKCE, dynamic client registration for assistants, and client credentials for your own services. Access tokens last an hour, refresh tokens rotate, and reusing an old refresh token revokes the whole grant. People can see and disconnect every connected app from their workspace.

No shortcuts for machines. The app, the API and the MCP server go through the same permission checks. A key can never be given more than its creator holds, and an assistant never gets more than your role allows today.

Build on it before everyone else does.

HeySender is not open for signups yet. The free Developer plan includes the API and the MCP server.

Request my early access