Policies & help › Developers
Developer Portal
The planned Indo Mail Developer Portal, the terms every developer will accept, and how to ask for early access today.
1. Status
The Developer Portal is planned and is not live. There is no portal website, no app registration, no API keys and no sandbox yet. What exists today is a live first-party API at https://indoemail.in that you can use for your own account (see the API Documentation), and example clients (see the SDK Documentation).
This page explains what we plan to offer, the rules we will ask developers to follow, and how to join the early-access list. We want developers to see the rules early so that they can tell us if something is unreasonable.
2. Planned features
| Feature | What it will do | Status |
|---|---|---|
| Developer account | One sign-in with your Indo Mail account and 2-Step Verification, plus your organisation details | Planned |
| App registration | Name, logo, privacy notice link, support address and redirect addresses for each app | Planned |
| OAuth 2.0 and OpenID Connect | Let users approve limited access to your app and sign in with Indo Mail | Planned |
| API keys | Scoped keys for scripts that work on your own account, which you can create and revoke | Planned |
| Versioned API (/api/v2) | A stable API with a published reference and a changelog | Planned |
| Webhooks | Signed event calls with retries for up to 24 hours | Planned |
| Sandbox | Test accounts and a test domain with sample mail, where nothing is sent to real people | Planned |
| Usage dashboard | Requests, errors and rate-limit use for each app | Planned |
| App review | A checklist and a review queue for apps that want restricted permissions | Planned |
| SDKs | JavaScript, Python, Android, iOS and a command-line tool | Planned |
| Status and changes page | Incidents, planned changes and deprecation notices by email | Planned |
| Developer support | A mailbox and a monthly office-hours call | Planned |
Features will appear one by one. We will publish each on indoemail.in when it is ready, and announce it to the early-access list first.
3. What you can do today
- Use the live API with your own account to automate your own mail, files, contacts and payment requests.
- Use Tag Manager on your website to count conversions without cookies, if you advertise with us.
- Use the ad-network endpoint to show contextual ads, if we have agreed it with you.
- Use mailto: links, which open Indo Mail's compose window and need no code.
- Use Web Push and the live stream for notifications for your own account.
4. Developer terms (planned)
Every developer will accept the following terms when they register. They are written in plain English and sit beside the Terms of Service, the Privacy Policy and the Acceptable Use rules. If a rule is broken, we can limit, suspend or end an app.
4.1 No spam and no abuse
- Do not use the API or an app to send spam, bulk unsolicited mail, phishing, malware or scams.
- Do not collect email addresses by scraping, guessing or buying lists.
- Do not pretend to be Indo Mail, another company or another person. Do not use the Indo Mail name or logo in a way that suggests we run or endorse your app.
- Follow the Bulk Sender rules if your app sends mail on behalf of others.
- Do not use the API to harass, stalk, threaten or harm any person, or to break any law.
4.2 No data resale
- Do not sell, rent or trade any data you receive from Indo Mail or from our users, directly or through a third party.
- Do not use that data for advertising, profiling, credit scoring, surveillance or to train artificial intelligence models.
- Use data only for the feature that the user asked for, and ask for permission again before you use it for something new.
- Delete a user's data within 30 days after they disconnect your app or ask you to, unless the law requires you to keep it.
- Tell users clearly what you collect, in a privacy notice that follows the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
4.3 Security
- Keep client secrets, API keys and tokens out of public code, web pages, mobile apps and logs.
- Send all data over HTTPS and store tokens and user data encrypted.
- Ask for the smallest set of permissions that works.
- Verify webhook signatures and OAuth state values.
- Report a security incident that affects Indo Mail users to security@indoemail.in without delay, and in any case within six hours of finding out, so that we can meet the CERT-In Directions of 28 April 2022.
- Never test on other people's accounts. Use the sandbox, or your own account. Good-faith security research that follows our security policy is welcome.
4.4 Rate limits and fair use
- Each app and each account has request limits. Limits will be published and shown in response headers.
- Respect 429 responses. Wait, then retry with growing delays.
- Do not try to get around limits by using many apps, many keys or many accounts.
- A message can have at most 100 recipients, and an account can send to at most 500 recipients in a day. These limits protect everyone and are not for sale.
- We may lower the limits for an app that causes harm to the service or its users.
4.5 Changes and 12-month deprecation
- We will give at least 12 months' notice by email and on indoemail.in before we remove or change in a breaking way any feature of the stable API.
- The exception is a change we must make at once for security or because the law requires it. We will tell you as soon as we can.
- New, backward-compatible additions can happen at any time.
- Beta and early-access features can change without that notice, and are marked as such.
4.6 Review, suspension and ending
- We may review your app, your privacy notice and your use of the API at any time to check these terms.
- We may suspend an app at once if it puts users at risk. We will tell you why and give you a chance to fix the problem.
- You can stop using the portal at any time by removing your apps. We will then revoke their tokens.
- If the law requires us to share information about your app with an authority, we will follow the process in our law-enforcement guidelines.
4.7 Liability and law
- The portal and any early-access features are given as they are. We work hard to keep them reliable but do not promise that they will never be down or change.
- You are responsible for your app, for what it does with user data and for answering to your users.
- These terms are governed by the laws of India. Courts in Kolkata, West Bengal have exclusive jurisdiction, subject to any rights you have under consumer law.
5. Early access
We are building the portal with a small group of developers first. To join the early-access list, write to contact@indoemail.in with the subject line Developer access. In the email, tell us:
- Who you are and, if you are a company, its name and website.
- What you want to build, and which parts of Indo Mail it would use.
- Which of the planned features matter most to you.
- What data your app would handle, and how you would protect it.
We reply within seven working days. Early access is free. It has no promise of dates or of a place in the final product, and we may ask you to sign a short agreement that follows the developer terms above. We do not share your details with anyone else.
6. Contact
Early access and developer questions: contact@indoemail.in, subject "Developer access". Security reports: security@indoemail.in. Abuse by an app: abuse@indoemail.in.
INDO CHATS PRIVATE LIMITED, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India.
This document is governed by the laws of India.