What happens if the token is missing, invalid or expired?

The editor resolves to the free plan. Nothing paid is ever unlocked in the browser.

Can a token turn on a feature the plan does not include?

No. The effective features are the plan's features intersected with the features enabled on the token, so a request above the plan is clamped by the server.

Can I limit where a token works?

Yes. Set allowed_domains on the token. An empty list allows any origin, otherwise the request host must match or be a subdomain.

How many embed tokens does each plan include?

Free includes 1, Pro 5, AI Pro 10 and Enterprise 25.

Embed tokens

Embedding & plans

Embed tokens

A publishable token (pk_live_…) scopes a workspace's plan and enabled features. You issue it from your MailKaro dashboard and pass it to the editor.

tsx

<EmailEditor token="pk_live_xxxxxxxx" project="marketing" />

How enforcement works#

On load, the editor calls GET /embed/runtime?token=…&project=…. The server runs the full validation chain and returns the effective entitlements:

Token exists and is active.
The request Origin is allowed (empty allow-list = any origin; else host must match or be a subdomain; *.vercel.app matches only subdomains; a port such as localhost:5173 must match).
Effective plan = the account's real plan, capped by the token's own expiry and the account's end date, a token never outlives its account.
Effective features = plan features ∩ the token's enabled features.

Any failure resolves to the free editor. Nothing paid is ever unlocked client-side.

Per-token feature scopes#

Each token can enable a subset of its plan's paid features (grouped in the dashboard: AI, exports, editor tools, collaboration, assets, white-label, shared library, governance, SSO). A paid feature the token omits is forced off; requested features are always clamped to the plan, the server never trusts the client.

Turning a capability on is a per-token checkbox you can change anytime, like GitHub permission scopes. In the dashboard open a token, mark each feature true/false, and save; create-time and later updates work the same way and apply on the editor's next load. Two to know:

AI, two separate checkboxes, both on Pro, AI Pro & Enterprise, never Free:
- AI Helper, the per-block "Improve with AI" (headings, text, HTML, …).
- AI Assistant, the whole-canvas conversational assistant. Turning it on automatically includes the AI Helper; you can also enable the Helper on its own.
On AI Pro the AI is provided by us, just check the boxes. On Pro / Enterprise you bring your own AI token; until it's wired the control shows disabled. (An AI-Pro customer may wire their own token too, then that request runs on their key and doesn't spend AI-Pro credits.)
White-label branding, check it on to show only your own logo in the editor, with no "Powered by MailKaro" badge at all; off keeps the MailKaro badge.

Token properties#

Field	Type	Default	Description
`duration`	"1w"\|"1m"\|"1y"\|"never"	-	Validity window.
`allowed_domains`	string[]	-	Origin allow-list (empty = any).
`features`	MailkaroFeatureKey[]	-	Enabled paid features (clamped to plan). See Plans.
`status`	"active"\|"inactive"	-	Deactivate without deleting.

Free includes one token; Pro and Enterprise raise the limit (default 5 per org).

Frequently asked questions#

What is an embed token?: A publishable key (pk_live_) that scopes a workspace's plan and enabled features. You issue it from your MailKaro dashboard and pass it to the editor.
What happens if the token is missing, invalid or expired?: The editor resolves to the free plan. Nothing paid is ever unlocked in the browser.
Can a token turn on a feature the plan does not include?: No. The effective features are the plan's features intersected with the features enabled on the token, so a request above the plan is clamped by the server.
Can I limit where a token works?: Yes. Set allowed_domains on the token. An empty list allows any origin, otherwise the request host must match or be a subdomain.
How many embed tokens does each plan include?: Free includes 1, Pro 5, AI Pro 10 and Enterprise 25.