# Khat

> Transactional email for startups, indie developers and hackathon teams. Send from
> your own verified domains with per-domain DKIM signing, track delivery from the mail
> server's own log, handle bounces and suppression, receive replies, and fire signed
> webhooks. No per-message fee.

Built by ScanMyPass (https://scanmypass.com).

## How it works, in one paragraph

Base URL: https://mail-api.scanmypass.com
Authentication: `Authorization: Bearer <api key>` on every endpoint except /health.
Sending is asynchronous: POST /v1/emails returns 202 queued, NOT delivered. Poll
GET /v1/emails/{id} or subscribe to a webhook for the outcome. A domain must pass SPF
and DKIM verification before it can send. Sending allowance is counted per recipient,
so one message to fifty people spends fifty.

## Pricing

- [Pricing](https://khat.scanmypass.com/pricing): Full detail.
- Free: ₹0/month (INR) — 5k emails a month, 1 receiving mailbox, 1 GB of mailbox storage.
- Pro: ₹499/month (INR) — 100k emails a month, 2 receiving mailboxes, 2 GB of mailbox storage.
- Scale: ₹999/month (INR) — 300k emails a month, 5 receiving mailboxes, 2 GB of mailbox storage.
- Business: ₹1,999/month (INR) — 1M emails a month, 15 receiving mailboxes, 4 GB of mailbox storage.
- Custom: above a million a month, priced to the traffic.
- Messages are counted per recipient. There is no per-message fee.
- Mailbox storage applies to received mail only; sending consumes none of it. It is
  pooled across the whole account rather than allotted per mailbox.
- Stored mail is encrypted at rest with AES-256-GCM.

## Get started

- [Setup](https://khat.scanmypass.com/docs/setup): Add your domain, publish four DNS records, create an API key and send your first message with Khat. Most people are through it in an afternoon.
- [DNS records](https://khat.scanmypass.com/docs/dns): What SPF, DKIM, DMARC and the return path each do, how to publish them at any provider, and every failure mode with its fix.

## Reference

- [Sending mail](https://khat.scanmypass.com/docs/sending): Send transactional email over HTTP: recipients, HTML and text, attachments, inline images, scheduling and custom headers, with examples in five languages.
- [Receiving mail](https://khat.scanmypass.com/docs/receiving): Accept replies on your own domain, read them in the inbox or receive them as webhooks, and restrict which addresses are accepted.
- [Delivery & webhooks](https://khat.scanmypass.com/docs/tracking): Every status a message can have, what the difference between sent and delivered actually is, bounce handling, suppression lists and signed webhooks.
- [Errors & limits](https://khat.scanmypass.com/docs/errors): Every error code the API returns, what causes it, and how sending allowance and rate limits are counted.
- [Security](https://khat.scanmypass.com/docs/security): How your DKIM keys, API keys and message data are isolated from every other account, what is never exposed, and how to report a vulnerability.

## Optional

- [Raw markdown](https://mail-api.scanmypass.com/docs): The API reference and DNS guide as unrendered
  markdown, if that is easier to consume than the pages above.
- [Health](https://mail-api.scanmypass.com/health): Liveness probe.
- [Readiness](https://mail-api.scanmypass.com/ready): Database, queue and mail-server status.

## Things that are commonly got wrong

- A domain may publish only ONE SPF record. Merge includes rather than adding a second.
- POST /v1/emails is not idempotent. Retry only on no response, 429, or 503 — never on
  a 500, which may have queued the message before failing.
- `sent` means our server accepted the message; `delivered` means the recipient's did.
  They are different claims.
- Attachments are base64 in the JSON body. There is no `url` option, deliberately.
- Inbound HTML is returned exactly as it arrived. Render it sandboxed or use the text
  part.