---
title: "Freshly Minted: what's new in October"
description: "Our October roundup with sandbox mode, Single Sign-On, readable inbound addresses and a batch of smaller improvements."
url: "https://lettermint.co/blog/freshly-minted-whats-new-in-october"
published: "2026-10-29"
last_updated: "2026-10-29"
---

# Freshly Minted: what's new in October

> Our October roundup with sandbox mode, Single Sign-On, readable inbound addresses and a batch of smaller improvements.

Welcome to the fifth edition of *Freshly Minted*, our
monthly round-up of everything we've built at Lettermint,
including the smaller improvements that never quite make
it to the changelog. The clocks went back last weekend,
and we hope your cron jobs made it through. This month we
finished two things that sat on our roadmap for a long
time: a safe way to test, and one login for your whole
team.

![Lettermint sandbox mode](https://lettermint.co/content/changelog/lettermint-sandbox.webp)

## Test your emails without sending them

Testing an email integration usually means sending a few
emails to yourself and hoping none reach a real customer.
Do that every time you change something, and the bounces
start to hurt your domain's reputation.

Sandbox mode is a setting per project. Lettermint handles
every email as usual, through the same API, SMTP and
validation, and stops right before the recipient's mail
server. The email shows up in your dashboard, your
[webhooks](https://lettermint.co/changelog/webhooks-for-team-projects-or-routes)
fire, and nothing lands in an inbox.

- **Pick the outcome**: test a hard bounce, a spam complaint, a click or an unsubscribe with [a single field](https://lettermint.co/docs/platform/projects-and-routes/sandbox-mode) in your API request or a header over SMTP.
- **No side effects**: sandbox emails don't count toward your usage, stay out of your statistics and never end up on your suppression list.
- **Made for CI**: give your test suite its own sandbox project, send from a domain you haven't verified yet, and check that your webhook handler does the right thing.

New webhooks only receive live events, so set them to
*Sandbox* or *Both* while you test. Available on
[Starter, Growth and Pro](https://lettermint.co/pricing).
[Read the changelog](https://lettermint.co/changelog/test-your-email-integration-with-sandbox-mode).

## Single Sign-On for your whole team

Your team can now log in to Lettermint through your own
identity provider, over SAML or OIDC. Colleagues log in
with their work email and land in your team right away,
without waiting for an invite. When someone leaves, you
remove their access in one place.

Plenty of providers keep SSO behind an enterprise
contract. We see it as basic security, so it's included in
every [paid plan](https://lettermint.co/pricing). The same
goes for
[SCIM](https://lettermint.co/docs/platform/teams/scim),
which adds and removes team members for you and can give
groups like Engineering or Support their own
[role](https://lettermint.co/changelog/give-team-members-and-clients-the-right-access-rbac).

Our [docs](https://lettermint.co/docs/platform/teams/sso)
have step-by-step guides for Okta, Microsoft Entra ID and
Google Workspace, and for
[European](https://lettermint.co/european-email)
providers like ZITADEL and cidaas.
[Read the changelog](https://lettermint.co/changelog/log-in-with-single-sign-on-sso).

## Better inbound email

Every
[inbound route](https://lettermint.co/features/inbound-emails)
now has its own domain, like `k7x2m9qpfa.lettermint.app`.
Put any name in front of it, such as `support@` or
`invoices@`, and the email reaches your route. Use a
different name for every place you share the address, and
plus addressing works too. Your existing
`@inbound.lettermint.co` address keeps working.
[See how it works](https://lettermint.co/docs/platform/inbound-mail/introduction#route-domain).

When we refuse an inbound email, you now hear about it.
The sender always got a bounce, but your app never knew
the email existed. The new
[`inbound.rejected`](https://lettermint.co/docs/platform/webhooks/events#inboundrejected)
webhook fires when we reject an email for your route
because it's larger than 25 MB, carries a blocked
attachment or is caught in a mail loop. It tells you who
sent it and why, never what was in it.

## Improvements & fixes

Beyond the headliners, we polished a lot of smaller things
too:

- **New major SDK versions**: for Node.js, PHP, Laravel, Python, Go, Java, .NET, Elixir and Rust. Each has an [upgrade guide](https://lettermint.co/docs/sdks#sdk-upgrade-guides) with every breaking change and a prompt you can hand to your coding agent.
- **Terraform provider**: manage projects, sending domains, routes and webhooks as code. Find it on the [Terraform Registry](https://registry.terraform.io/providers/lettermint/lettermint/latest) as `lettermint/lettermint`.
- **Safe retries for batch sends**: give each email in a batch its own [idempotency key](https://lettermint.co/docs/platform/emails/idempotency#batch-sending). If a batch fails halfway, send it again and the emails that already went out aren't sent twice.
- **Webhooks behind Basic Auth**: add a [username and password](https://lettermint.co/docs/platform/webhooks/introduction#basic-authentication) to a webhook, so you can test against a staging site that sits behind a login.
- **Retry a failed webhook yourself**: from the dashboard, the API or [MCP](https://lettermint.co/features/mcp), instead of waiting for the next attempt. Each failed delivery also shows [when the next automatic retry is due](https://lettermint.co/docs/platform/webhooks/introduction#retry-a-failed-delivery).
- **API tokens through MCP**: [last month](https://lettermint.co/blog/freshly-minted-whats-new-in-september) we wrote that your AI assistant can't touch your tokens. One exception now: when you move over from another provider, it can create a project API token and put it in your app's config. It asks you to confirm first and shows the token only once.

Several of these started as a message from someone using
Lettermint, Basic Auth for webhooks and manual retries
among them. So keep them coming, through the dashboard or
[Discord](https://lettermint.co/r/discord). We read every
message.

*See you in November, and good luck to everyone sending
Black Friday campaigns. Sending more than usual? Read
[how to stay out of the spam folder](https://lettermint.co/knowledge-base/deliverability/prevent-emails-spam-holidays-gmail-outlook)
first.*