Before you start
Use the public Mail API from a trusted server or background worker. A Lucion Global administrator can create a key for a shared mailbox; the integration itself does not need a Lucion Identity or Mail login. Key creation requires a verified Lucion Identity email and a server-side secret store for credentials.
- For interactive product use, sign in through your own Lucion Identity account in the Mail application.
- For server integrations, create a scoped API key in Settings → API keys and select a shared mailbox.
- Use separate keys for separate services, environments, and owners where practical.
- Start with the narrowest scope and a finite expiration. Choose “Never” only when ongoing credential rotation and access review are owned.
Your first integration
- Open the API keys guide and create a key with only the required capability.
- Copy the key once to a server-side secret manager. Never put it in browser code or a URL.
- Follow the Quickstart to make a read request or an idempotent send.
- Handle status codes and rate limits as described in Errors and Limits.
- Verify the production deployment and monitor key use before relying on it for important mail.
Start with a test mailbox and low-volume use. A provider acceptance response does not prove recipient delivery.
Available capabilities
API v1 supports mailbox message reads and plain-text sends. Organization API keys can be bound by an administrator to one shared mailbox; they cannot select another mailbox or read an employee's personal inbox. The API does not provide mailbox mutation, attachment transfer, HTML bodies, or scheduled sends.
The API reference is the source of truth for supported paths and fields. The machine-readable contract is available as OpenAPI JSON.
Production checklist
- Use HTTPS and keep API keys outside client bundles, logs, issue trackers, and analytics.
- Use `mail.read` and `mail.send` independently unless both are required.
- Prefer 7-, 30-, or 90-day expiry. For a non-expiring key, assign an owner and recurring review date.
- Reuse an idempotency key when retrying an uncertain send.
- Revoke keys promptly when a service is retired or a credential may have been exposed.
- Check the live health endpoint and the dated changelog.