Freshly Minted: what's new in October

Welcome to the fifth edition of Freshly Minted, our monthly round-up of everything we've built at Lettermint, including the smaller improvements that never quite make it to the changelog. The clocks went back last weekend, and we hope your cron jobs made it through. This month we finished two things that sat on our roadmap for a long time: a safe way to test, and one login for your whole team.

Test your emails without sending them

Testing an email integration usually means sending a few emails to yourself and hoping none reach a real customer. Do that every time you change something, and the bounces start to hurt your domain's reputation.

Sandbox mode is a setting per project. Lettermint handles every email as usual, through the same API, SMTP and validation, and stops right before the recipient's mail server. The email shows up in your dashboard, your webhooks fire, and nothing lands in an inbox.

• Pick the outcome: test a hard bounce, a spam complaint, a click or an unsubscribe with a single field in your API request or a header over SMTP.
• No side effects: sandbox emails don't count toward your usage, stay out of your statistics and never end up on your suppression list.
• Made for CI: give your test suite its own sandbox project, send from a domain you haven't verified yet, and check that your webhook handler does the right thing.

New webhooks only receive live events, so set them to Sandbox or Both while you test. Available on Starter, Growth and Pro. Read the changelog.

Single Sign-On for your whole team

Your team can now log in to Lettermint through your own identity provider, over SAML or OIDC. Colleagues log in with their work email and land in your team right away, without waiting for an invite. When someone leaves, you remove their access in one place.

Plenty of providers keep SSO behind an enterprise contract. We see it as basic security, so it's included in every paid plan. The same goes for SCIM, which adds and removes team members for you and can give groups like Engineering or Support their own role.

Our docs have step-by-step guides for Okta, Microsoft Entra ID and Google Workspace, and for European providers like ZITADEL and cidaas. Read the changelog.

Better inbound email

Every inbound route now has its own domain, like k7x2m9qpfa.lettermint.app. Put any name in front of it, such as support@ or invoices@, and the email reaches your route. Use a different name for every place you share the address, and plus addressing works too. Your existing @inbound.lettermint.co address keeps working. See how it works.

When we refuse an inbound email, you now hear about it. The sender always got a bounce, but your app never knew the email existed. The new inbound.rejected webhook fires when we reject an email for your route because it's larger than 25 MB, carries a blocked attachment or is caught in a mail loop. It tells you who sent it and why, never what was in it.

Improvements & fixes

Beyond the headliners, we polished a lot of smaller things too:

• New major SDK versions: for Node.js, PHP, Laravel, Python, Go, Java, .NET, Elixir and Rust. Each has an upgrade guide with every breaking change and a prompt you can hand to your coding agent.
• Terraform provider: manage projects, sending domains, routes and webhooks as code. Find it on the Terraform Registry (opens in a new window) as lettermint/lettermint.
• Safe retries for batch sends: give each email in a batch its own idempotency key. If a batch fails halfway, send it again and the emails that already went out aren't sent twice.
• Webhooks behind Basic Auth: add a username and password to a webhook, so you can test against a staging site that sits behind a login.
• Retry a failed webhook yourself: from the dashboard, the API or MCP, instead of waiting for the next attempt. Each failed delivery also shows when the next automatic retry is due.
• API tokens through MCP: last month we wrote that your AI assistant can't touch your tokens. One exception now: when you move over from another provider, it can create a project API token and put it in your app's config. It asks you to confirm first and shows the token only once.

Several of these started as a message from someone using Lettermint, Basic Auth for webhooks and manual retries among them. So keep them coming, through the dashboard or Discord. We read every message.

See you in November, and good luck to everyone sending Black Friday campaigns. Sending more than usual? Read how to stay out of the spam folder first.