# SRS Postline

> Transactional email infrastructure: REST API + SMTP send, domain verification (SPF/DKIM/DMARC), suppression lists, signed webhooks. Live keys are available immediately. Until a customer From-domain is verified, use the shared sandbox sender only for project-member recipients; quotas and abuse controls apply on every plan.

Base URL: `https://api.srs-postline.com` (local dev: `http://localhost:18080`). Auth: `Authorization: Bearer srs_live_...` (`srs_test_...` is legacy) — never place a key in frontend or client code. Get one from the user or have them create a restricted key; do not fabricate one.

## Docs

- [AI/agent integration guide](https://srs-postline.com/en/ai/): What to call, in what order, and which checks to run before every send — read this before generating request code.
- [OpenAPI schema](https://srs-postline.com/openapi/postline.yaml): Full REST API schema — endpoints, request/response shapes, error codes.
- [Integration guide](https://srs-postline.com/guides/integration-guide.md): Copy-paste examples in 15 languages (cURL, JavaScript, TypeScript, Python, PHP, Go, Java, Kotlin, C#, Ruby, Rust, Swift, Dart, PowerShell, C++).
- [API reference](https://srs-postline.com/en/api/): Human-readable API reference.
- [Webhooks](https://srs-postline.com/en/webhooks/): Signature verification, delivery guarantees, and outbound controls.
- [Production checklist](https://srs-postline.com/en/docs/): Domain verification, sandbox limits, and what changes at go-live.
- [Security](https://srs-postline.com/en/security/): Security controls and limitations.

## Discovery

- [auth.md](https://srs-postline.com/auth.md): How agents provision and use dashboard-issued Bearer API keys.
- [OAuth Protected Resource Metadata](https://srs-postline.com/.well-known/oauth-protected-resource): RFC 9728 resource, authorization servers, and scopes.
- [OAuth Authorization Server](https://srs-postline.com/.well-known/oauth-authorization-server): RFC 8414 discovery (issuer, endpoints, `agent_auth`).
- [OpenID configuration](https://srs-postline.com/.well-known/openid-configuration): OIDC discovery document for the same issuer (Postline does not issue ID tokens).
- [ARD manifest](https://srs-postline.com/.well-known/ai-catalog.json): Agentic Resource Discovery capability manifest.
- [api-catalog](https://srs-postline.com/.well-known/api-catalog): RFC 9727 linkset (service-desc/service-doc/status).
- [MCP endpoint](https://api.srs-postline.com/mcp): Hosted Streamable HTTP server for one-command connection from MCP clients.
- [MCP server card](https://srs-postline.com/.well-known/mcp/server-card.json): Machine-readable transports, authentication, and tool list.
- [Agent skill](https://srs-postline.com/.well-known/agent-skills/postline-email-integration/SKILL.md): SKILL.md for wiring up transactional email sending.

## Optional

- [Cookie and browser-storage inventory](https://srs-postline.com/guides/cookies-and-browser-storage.md): What Postline stores client-side.
- [Changelog](https://srs-postline.com/en/changelog/): Release notes.