HiheMAX Mail product manual
Set up business email,
then keep it working.
One complete manual.
Follow complete workflows for administrators, mailbox users, campaign operators and developers. Every chapter names the route to open, prerequisites, expected result and common failure.
Create a working email workspace
The workspace account administers domains, mailboxes, templates, campaigns, API keys and billing. It is different from a mailbox login.
Create the workspace
Choose the next workflow
Know the two logins
Connect a domain without interrupting mail blindly
Add the domain in HiheMAX Mail, publish the exact records shown for that domain, then verify before creating mailboxes.
Add the domain
Copy generated DNS
Remove conflicts carefully
Verify
Confirm the result
Create and manage professional addresses
A mailbox is an actual account under a verified domain, with its own address, password, storage quota and optional forwarding settings.
Check prerequisites
Create the account
Share access safely
Update or remove
Use the inbox, not a decorative preview
Webmail operates against the currently selected mailbox. The interface combines folders, message results, the reader and adjacent productivity tools.
Enter webmail
Read and organise
Compose
Use workspace tools
Turn contacts into reusable groups
Contacts support everyday address-book use and campaign audiences. Groups are labels stored on each contact.
Create a contact
Assign groups
Maintain consent
Check duplicates
Build reusable messages with safe variables
Templates hold a subject, HTML design, optional text alternative, category and lifecycle status. API and campaign sending require an active template.
Create
Add variables
Preview and test
Activate
Prepare, test, review and send a campaign
Campaigns combine one active template, a subject and one or more contact groups. Delivery consumes the same visible email credits as API sending.
Prepare the audience
Create the campaign
Inspect preview
Run preflight
Confirm delivery
Send from a backend with an attributable key
One versioned API and a TypeScript SDK cover transactional and template sending, batch delivery, hosted email verification, your own mailboxes, account inspection and usage history. Every action is metered in credits and charged to the calling key.
Enable developer tools
Store the key server-side
Use the base URL
Install the SDK
npm install @hihemax/mailUnderstand metering
Create, copy, rotate and revoke API keys
Keys authenticate every request and are attributed to every metered action. Keys are stored encrypted server-side, can be re-copied when you need the raw value again, and are revoked independently.
Send a key two ways
# Either header authenticates the same key. Bearer:
curl https://mail.hihemax.com/api/v1/send \
-H "Authorization: Bearer hm_your_key" \
-H "Content-Type: application/json" \
-d '{"to": "a@example.com", "subject": "Hi", "text": "Hello!"}'
# Or X-API-Key:
curl https://mail.hihemax.com/api/v1/send \
-H "X-API-Key: hm_your_key" \
-H "Content-Type: application/json" \
-d '{"to": "a@example.com", "subject": "Hi", "text": "Hello!"}'Copy a key again
Rotate when a key is exposed
Revoke a key
Handle authentication errors
Send transactional messages, templates and batches
POST /send accepts direct content or an active template and can send as one of your own mailboxes. POST /send/batch delivers up to 100 messages in one request. Each delivered message counts as one credit.
Send direct content
curl -X POST https://mail.hihemax.com/api/v1/send \
-H "X-API-Key: hm_your_key" \
-H "Content-Type: application/json" \
-d '{
"to": "customer@example.com",
"subject": "Your receipt",
"text": "Payment received."
}'Send an active template
curl -X POST https://mail.hihemax.com/api/v1/send \
-H "Authorization: Bearer hm_your_key" \
-H "Content-Type: application/json" \
-d '{
"to": "customer@example.com",
"templateId": "YOUR_ACTIVE_TEMPLATE_ID",
"variables": { "first_name": "Ada", "order_id": "HM-1042" }
}'Send as one of your mailboxes
curl -X POST https://mail.hihemax.com/api/v1/send \
-H "Authorization: Bearer hm_your_key" \
-H "Content-Type: application/json" \
-d '{
"to": "ada@example.com",
"subject": "Your order receipt",
"text": "Thanks for your order!",
"fromName": "Acme Receipts",
"fromAccount": "hello@acme.com"
}'Read the response
{
"success": true,
"id": "<message-id>",
"to": ["customer@example.com"],
"from": "hello@acme.com",
"creditsRemaining": 97,
"requestId": "req_abc123"
}Send a batch
curl -X POST https://mail.hihemax.com/api/v1/send/batch \
-H "Authorization: Bearer hm_your_key" \
-H "Content-Type: application/json" \
-d '{
"messages": [
{ "to": "a@example.com", "subject": "Receipt", "text": "Thanks" },
{ "to": "b@example.com", "subject": "Receipt", "text": "Thanks" }
]
}'List your mailboxes and send as them
The email-accounts API lists every mailbox your workspace owns. Any usable mailbox can become the From address of an API send, so replies land in your own inbox on a verified domain.
List your mailboxes
curl https://mail.hihemax.com/api/v1/email-accounts \
-H "Authorization: Bearer hm_your_key"Understand the account object
{
"accounts": [
{
"id": "mailbox_abc123",
"emailAddress": "hello@acme.com",
"displayName": "Acme Support",
"domainId": "dom_xyz",
"domainName": "acme.com",
"domainVerified": true,
"active": true,
"usable": true,
"storageQuota": 10737418240,
"storageUsed": 24117248,
"forwardingAddress": null,
"logoId": null,
"createdAt": "2026-06-10T08:00:00.000Z"
}
],
"requestId": "req_01"
}Use the usable flag
Get one mailbox
Send as the mailbox
Handle sender rejections
| Code | Meaning |
|---|---|
| unknown_sender | The account id or address does not exist or is not yours |
| sender_domain_not_verified | The owning domain is not verified |
| sender_inactive | The mailbox is disabled |
| sender_no_credentials | The mailbox has no usable credentials |
| sender_auth_unavailable | Encrypted credentials could not be decrypted |
Create a mailbox through the API
Host subdomains for your users
# 1. Provision the tenant subdomain (auto-verified: you own brnd.ng)
curl -X POST https://mail.hihemax.com/api/v1/domains \
-H "Authorization: Bearer hm_your_key" \
-H "Content-Type: application/json" \
-d '{ "domain": "alice.brnd.ng" }'
# 2. Create a mailbox under it (free; plan mailbox cap applies)
curl -X POST https://mail.hihemax.com/api/v1/email-accounts \
-H "Authorization: Bearer hm_your_key" \
-H "Content-Type: application/json" \
-d '{
"domain": "alice.brnd.ng",
"localPart": "info",
"password": "use-a-strong-password",
"displayName": "Alice Shop"
}'Point DNS once, then per subdomain
# One-time DNS at the brnd.ng registrar (covers every subdomain)
*.brnd.ng. MX 10 mail.hdock.app.
*.brnd.ng. TXT "v=spf1 include:hdock.app ~all"
_brnd DMARC stays on the parent: _dmarc.brnd.ng. TXT "v=DMARC1; p=none"
# Per claimed subdomain, publish the DKIM record from POST /domains
<selector>._domainkey.alice.brnd.ng. TXT "v=DKIM1; k=rsa; p=<public-key>"Add hosted OTP and magic-link email verification
Start a verification with one request; HiheMAX Mail renders and delivers the email, then your server checks the code or the user follows a signed link back.
Start a verification
curl -X POST https://mail.hihemax.com/api/v1/verify/start \
-H "Authorization: Bearer hm_your_key" \
-H "Content-Type: application/json" \
-d '{
"email": "user@example.com",
"type": "otp",
"codeLength": 6,
"expiresIn": 900,
"brandName": "Acme"
}'Check an OTP
curl -X POST https://mail.hihemax.com/api/v1/verify/check \
-H "Authorization: Bearer hm_your_key" \
-H "Content-Type: application/json" \
-d '{ "verificationId": "ver_abc", "code": "123456" }'Use the magic-link flow
Build a secure flow
Account, usage, errors and the SDK client
Inspect the calling key and credit balance, read the usage ledger, decode every error response, and drive the entire API from the TypeScript SDK.
Inspect the key and balance
curl https://mail.hihemax.com/api/v1/me \
-H "Authorization: Bearer hm_your_key"{
"success": true,
"key": { "id": "key_abc", "label": "production" },
"credits": { "balance": 97, "currency": "USD" },
"usage": { "recentCount": 3, "recentCost": 3 },
"requestId": "req_abc123"
}Read the usage ledger
curl "https://mail.hihemax.com/api/v1/usage?limit=50" \
-H "Authorization: Bearer hm_your_key"Decode the error envelope
{
"success": false,
"error": {
"type": "insufficient_credits",
"code": "insufficient_credits",
"message": "Insufficient credits"
},
"requestId": "req_xyz"
}| HTTP | Error type | Meaning |
|---|---|---|
| 400 | invalid_request | Validation failed; read the message field |
| 401 | authentication | Missing, malformed or revoked API key |
| 402 | insufficient_credits | Balance too low for the action |
| 404 | not_found | Resource missing or not yours |
| 429 | rate_limit | Too many requests; honor Retry-After |
| 5xx | server / provider | Server or downstream provider failure |
Respect the rate limit
Use the SDK start to finish
import { HihemaxMail } from '@hihemax/mail'
const mail = new HihemaxMail(process.env.HIHEMAX_API_KEY!)
// List the mailboxes your workspace owns
const { accounts } = await mail.emailAccounts.list()
const usable = accounts.filter((a) => a.usable)
// Send as one of your mailboxes
const res = await mail.emails.send({
to: 'ada@example.com',
subject: 'Your order receipt',
text: 'Thanks for your order!',
fromAccount: usable[0].id, // or usable[0].emailAddress
})
console.log('sent from', res.from)
// Inspect the key and balance
const me = await mail.account.me()
console.log(me.credits.balance)Where to look next
Understand what consumed credits
The API dashboard reads the real usage ledger. It does not estimate usage from UI activity.
Open the dashboard
Read the chart
Match actions
Query programmatically
Know when paid access renews or expires
Plan limits govern domains, mailboxes and storage. The subscription view combines the stored entitlement with verified Paystack state.
Choose a plan
Return and verify
Review renewal
Handle expiry
Keep four identities separate
Workspace sessions, mailbox credentials, API keys and infrastructure secrets have different purposes and must not be substituted for one another.
Workspace account
Mailbox account
API key
Provider secrets
Find the failing layer before retrying
Use the symptom to identify whether the problem is DNS, mailbox authentication, application validation, credits, provider delivery or subscription state.
| Symptom | Check first | Next action |
|---|---|---|
| Domain stays pending | Public TXT/MX lookup and exact host/value | Correct DNS, wait for TTL, then verify again |
| Cannot create mailbox | Domain verification and plan mailbox capacity | Verify domain or free/upgrade capacity |
| Webmail login fails | Full address, mailbox password and active account | Reset mailbox credentials from the workspace |
| Template send rejected | Template owner, ID and active status | Activate the correct workspace template |
| Campaign shows zero recipients | Selected group spelling on contacts | Edit contacts or choose a populated group |
| Campaign cannot send | Preflight recipient count and credit balance | Top up credits or reduce audience |
| API returns 401 | Header, raw key, revocation status | Use a valid server-side key |
| API returns 402 | Credit balance | Purchase credits before retrying |
| API returns 429 | Retry-After value | Back off; do not loop immediately |
| Rejected when sending as a mailbox | Mailbox active state and verified owning domain | Verify the domain or choose another usable mailbox |
| Key cannot be revealed again | Key created before encrypted key storage | Generate a new key and swap it in the backend |
| Subdomain rejected by the API | Parent ownership, spelling, wildcard use | Verify the parent first; claim subdomains one by one, never * |
| Mailbox creation hits account_limit_reached | Workspace plan mailbox cap | Upgrade the plan; each tenant mailbox counts |
| Accepted but not in inbox | Spam folder, recipient address and provider response | Separate acceptance from final delivery investigation |
| Plan looks expired | Settings subscription status and provider renewal | Verify transaction or renew through Paystack |
What to include in a support request
- • The affected route or product area.
- • The approximate timestamp and timezone.
- • The expected result and the actual result.
- • A safe error code or request ID, if present.
- • Never include passwords, raw API keys or payment credentials.