MailKaro Developer Resources

Everything you need to integrate the MailKaro embeddable email & document editor and its Cloud API. MailKaro gives your product a white-label drag-and-drop editor plus a server-side render and send API. Cloud API requests authenticate with a secret server key (sk_live_…) via Authorization: Bearer <key>. The publishable embed token (pk_live_…) is for the editor in the browser.

MailKaro API & machine-readable specs

• OpenAPI 3.1 specification, https://mailkaro.com/openapi.json
• Cloud API reference, endpoints, auth, examples
• Backend integration, mint tokens & render server-side
• Authentication, tokens & keys
• llms.txt, agent guidance & when to use MailKaro

MailKaro SDKs & packages

All packages are published on npm under the @mailkaro scope, click any package to open it on npm:

• react-email-craft, React embeddable editor, npm · docs
• vue-email-craft, Vue wrapper, npm · docs
• angular-email-craft, Angular wrapper, npm · docs
• vanilla-email-craft, vanilla JS wrapper, npm · docs
• email-craft-sdk, Node backend SDK: render designs & resolve entitlements, npm · docs

Authentication

Send Authorization: Bearer sk_live_… (a server key, kept on your backend) with every Cloud API request; a publishable pk_live_… token is refused there. POST /v3/render and POST /v3/import need no key. Requests are scoped to the key's organization. See the authentication docs.

Rate limits

Every MailKaro API response carries RFC RateLimit headers so agents can self-throttle: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset (seconds until the window resets), and RateLimit-Policy (quota;w=window-seconds). A 429 Too Many Requests also returns Retry-After. Back off until the reset window elapses.

Versioning & deprecation policy

The MailKaro API is versioned in the URL path (/v3/…); the current major version is v3. Breaking changes ship under a new path version. When an endpoint or version is deprecated, responses carry a Deprecation header and, once an end-of-life date is set, a Sunset header (RFC 8594) linking to migration docs. We aim to give at least 6 months between a Sunset announcement and removal, so you can integrate against a stable, path-versioned surface.

Error model

Every 4xx/5xx response uses a consistent typed body: a machine-readable error code and a human-readable message (see the Error schema in the OpenAPI spec), so agents can handle failures without guessing.