Send email with one POST.

Authentication

Every request carries an API key as a bearer token. Create keys in the dashboard under API Keys. Keys start with sh_ and are shown once — store them in your server environment, never in client-side code.

Authorization: Bearer sh_YOUR_API_KEY

Keys carry scopes — full_access for everything, or sending_access for send-only integrations — and can be restricted to a single verified domain. Send a repeated request safely by including an Idempotency-Key header: a retry with the same key returns the original result instead of sending twice.

Endpoints

All paths are relative to https://api.sendhustle.com. Requests and responses are JSON; list endpoints use cursor pagination.

Webhooks

Register an endpoint under Webhooks and we POST a JSON body for each event. Deliveries are retried with backoff, so your handler should be idempotent.

Verifying the signature

Each delivery carries X-SendHustle-Timestamp and X-SendHustle-Signature — an HMAC-SHA256, in hex, of <timestamp>.<raw body> using your endpoint's signing secret. Compare with a constant-time check and reject timestamps outside a few minutes to prevent replays. Svix-compatible headers are sent alongside if you prefer that library.

import crypto from 'crypto';

const ts = req.headers['x-sendhustle-timestamp'];
const sig = req.headers['x-sendhustle-signature'];
const expected = crypto
  .createHmac('sha256', process.env.WEBHOOK_SECRET)
  .update(`${ts}.${rawBody}`)
  .digest('hex');

const ok = crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));

Errors

Errors return the matching HTTP status with a JSON body containing a stable name and a human-readable message.

Rate limits

Sending is paced to protect deliverability for everyone: requests beyond the current window are queued rather than dropped, so a large campaign takes longer instead of failing. Your plan's monthly allowance is enforced separately — when it's used up, sending pauses until the next cycle or an upgrade, and we never bill silent overages. New accounts start with a lower daily allowance that lifts automatically as your sending history stays clean.