Cobinar Mail — Developer Console

⚡

—

Applications

📧

—

Emails Sent

✅

—%

Delivery Rate

🌐

—

Verified Domains

🚀 Quick Start

ℹ️ Register your app to get a Client ID, then add the domain(s) it'll call from — no secret to manage or leak.

1️⃣

Register App

Name your app and add the domain(s) it'll send from

2️⃣

Use the API

Pass your Client ID — your domain is verified automatically

3️⃣

Deliver

OTPs, transactional mail, and notifications reach users fast

🧪 Send a Test Email

Application

To

Subject

Body

Sent as plain text. Use the live API for HTML templates.

📋 Result

📨

Send a test email to see the response here.

📋

No logs yet

Logs appear here once your apps start sending.

📤 Send Transactional Email

POST /v1/send

// Client-side JS, running on a page at one of your allowed domains.
// The browser sets a real Origin header — Cobinar verifies it for you.
const res = await fetch('https://api.mail.cobinar.com/v1/send', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Client-ID': 'cob_your_client_id'
  },
  body: JSON.stringify({
    to:        'user@example.com',
    subject:   'Welcome to our platform!',
    html:      '<h1>Hello!</h1><p>You're in.</p>',
    text:      'Hello! You\'re in.',   // plaintext fallback
    from_name: 'My App'              // optional sender name
  })
});
// Response: { success: true, message_id: "msg_xxx", status: "sent" }
const data = await res.json();

// Node.js backend — no Origin header exists outside a browser, so
// declare which registered domain this call is on behalf of.
const res = await fetch('https://api.mail.cobinar.com/v1/send', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Client-ID':    'cob_your_client_id',
    'X-App-Domain':   'myapp.com'  // must be in your allowed domains
  },
  body: JSON.stringify({
    to:      'user@example.com',
    subject: 'Welcome to our platform!',
    html:    '<h1>Hello!</h1>'
  })
});
const data = await res.json();

🔐 Authentication

Cobinar Mail authenticates requests by Client ID + domain instead of a secret. No key to rotate, store, or leak — your registered domain does the proving.

🆔

Required Header

X-Client-ID: cob_xxxxxxxxxxxxxxxxxxxxxxxx

How the domain is determined, in order:

Source	When it's used
Origin	Browser-side calls — set by the browser itself, cannot be overridden by page JS
Referer	Fallback if Origin is absent
X-App-Domain	Backend calls with no browser context — you declare the domain explicitly

⚠️ Add every domain that will call the API under your app's settings first — unregistered domains are rejected with DOMAIN_NOT_ALLOWED.

ℹ️ This model is strongest for browser-triggered calls, since Origin can't be forged by JavaScript. For backend-to-backend integrations where anyone with network access could set X-App-Domain themselves, treat your Client ID with the same care as a key, and reach out if you'd like an optional shared secret layered on top for that app.

❌ Error Reference

Error Code	HTTP	Meaning
MISSING_CLIENT_ID	401	X-Client-ID header is missing
AUTH_INVALID	401	Client ID doesn't match any app
DOMAIN_NOT_ALLOWED	403	Calling domain isn't in this app's allowed list
APP_SUSPENDED	403	App suspended — contact support
RATE_LIMIT	429	Too many requests — slow down
QUOTA_EXCEEDED	429	Monthly send limit reached
INVALID_EMAIL	400	Recipient address is malformed
MISSING_FIELD	400	A required field is absent
OTP_EXPIRED	400	OTP has passed its expiry window
SEND_FAILED	500	Upstream delivery error — retry

👤 Profile

ℹ️ Custom Cobinar authentication will replace Google login in a future update.

⚠️ Account

Welcome, Builder

Dashboard

Applications

Test Sender

No applications yet

Email Logs

No logs yet

API Reference

Settings

Welcome, Builder

Dashboard

Applications

Test Sender

No applications yet

Email Logs

No logs yet

API Reference

Settings

⚡ New Application

App