---
title: "Freshly Minted: what's new in July"
description: "Our July roundup with custom roles and permissions, tighter control over your API tokens, a toggle that stops out-of-office replies and a batch of smaller improvements."
url: "https://lettermint.co/changelog/freshly-minted-whats-new-in-july"
published: "2026-07-30"
last_updated: "2026-07-30"
---

# Freshly Minted: what's new in July

> Our July roundup with custom roles and permissions, tighter control over your API tokens, a toggle that stops out-of-office replies and a batch of smaller improvements.

This is the second edition of *Freshly Minted*, our
monthly update from Lettermint. Every month we round up
what we've built, including the smaller improvements that
never quite make it to the changelog. July is the month
half your recipients are out of office and the other half
answers email from a beach chair. We stayed in and
shipped.

![Lettermint roles](https://lettermint.co/content/changelog/lettermint-roles.webp)

## Roles and permissions

This is the big one this month. Roles are not new, but the
set was short and fixed, so you often ended up granting
more than you meant to. You can now build your own on top
of the built-in ones, with permissions set individually
and access scoped to specific projects. A few examples:

- **A developer** assigned to one project, with access to its API tokens and webhooks and nothing outside it.
- **A colleague** who can manage sending and settings, while the privacy-sensitive content inside your messages stays hidden.
- **A client**: [agencies](https://lettermint.co/for/agencies) can give each client a login to their own project and nothing else.

Everyone you invite gets exactly the access they need.
[Read the changelog](https://lettermint.co/changelog/give-team-members-and-clients-the-right-access-rbac).

![Lettermint tokens overview](https://lettermint.co/content/changelog/lettermint-api-tokens.webp)

## Tighter control over your API tokens

Two additions that go in opposite directions, and both
came straight from customer requests.

- **IP allowlist**: restrict an API token to specific IP addresses. If the token is used from anywhere else, the request is refused and the attempt is logged, so you find out rather than wonder. [Read the changelog](https://lettermint.co/changelog/restrict-your-api-tokens-to-specific-ip-addresses).
- **Shorter keys for older hardware**: some devices, printers in particular, cap passwords at 25 characters and simply cannot store a normal Lettermint key. You can now generate a 25-character *legacy token* instead. It's opt-in, clearly labelled as the less secure option, and worth pairing with an IP allowlist.

[Last month](https://lettermint.co/changelog/freshly-minted-whats-new-in-june)
we made it possible to send an email with nothing but an
attachment, for exactly those scanners and printers.
Printers, it turns out, are still very much a thing in
2026.

## Stop out-of-office replies before they start

Send a newsletter to a few thousand people in July and
plenty of them are out of office. Every one of those
auto-replies lands in whatever inbox you set as reply-to.

A new `Suppress auto-responders` toggle in your route
settings adds two headers to everything you send through
that route, telling the recipient's mail server not to
fire a vacation reply. Real replies still get through,
"I'm currently away until the 18th" doesn't. So you keep a
proper reply-to address instead of falling back on
`noreply@`. Off by default, and set per route.

## Improvements & fixes

Beyond the headliners, we polished a lot of smaller things
too:

- **Webhook delivery at a glance**: webhook pages now open with KPI cards for deliveries, success rate and endpoint latency, each with a sparkline.
- **Wildcard inbound addresses**: catch every address under a subdomain with a single route, like `*@*.mail.example.com`, instead of adding one for each.
- **See the message behind a suppression**: every suppression now links back to the message that triggered it, so you can judge in seconds whether it should stay.
- **Request a delisting yourself**: spam complaints are the one kind of suppression you can't lift on your own, for good reason. You can now send one for review straight from the suppressions list instead of opening a support ticket.
- **API improvements**: the suppression list endpoint takes a start and end date so you can poll only what's new, core endpoints accept a project parameter so you don't have to filter on your side, and a new endpoint returns the current list of blocked attachment types as JSON.
- **Quicker inbound processing**: we improved how inbound messages are handed off, so webhooks fire sooner after a message arrives.

## One more thing

Not everything we finished this month is a feature. One
item has been on our roadmap for months, has nothing to do
with sending email, and everything to do with the company
behind it. It went through its final review this month.

That's all we're allowed to say for now. But you'll hear
about it early next month, on our website, on our socials
and right here in the next edition.

This month again, a good share of this started as a
message from someone using Lettermint. So keep it coming.
You can reach us through the dashboard or
[Discord](https://lettermint.co/r/discord). We read every
message and genuinely build with it.

*Enjoy the quiet inbox while it lasts*, and see you next
month.