Keep every team and client apart
A workspace holds your domains, inboxes, keys and teammates. Keep each client in its own, and switch between them with one sign in.
What it does
Three things you get, in plain words.
One workspace, everything in it
Your domains, inboxes, API keys, webhooks, mail and contacts all live in one workspace, with one plan.
Keys that can only do a little
A key can be full access, sending only (even for one domain), or limited to one inbox. If one leaks, the damage stays small.
Teammates and a record
Invite people with a role, limit them to some inboxes, and see who did what in an audit log. Export everything when you want a copy.
Limit what each key and teammate can do
Create keys with only the access each one needs, and give each teammate a role. Keep separate clients in separate workspaces.
# Sending only, and only from one domain
curl -X POST https://api.runearc.com/v1/keys \
-H "Authorization: Bearer $RUNEARC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name": "web app", "permissions": "sending", "domain_id": "dom_01jc..."}'
# Reading and replying in one inbox only
curl -X POST https://api.runearc.com/v1/keys \
-H "Authorization: Bearer $RUNEARC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name": "support bot", "permissions": "inbox", "inbox_id": "ibx_01jc..."}'
# The secret is shown once in the reply. Runearc keeps only a hash.In the dashboard, under Settings:
Members Invite by email. Choose a workspace role, and for a Member,
a member role and (optionally) which inboxes.
Audit log Who did what and when: keys, domains, inboxes, members.
Export Download everything in the workspace as one file.
The same things over the API (signed in):
POST /v1/invitations
{"email": "sam@acme.com", "workspace_role": "member",
"member_role": "support", "inbox_ids": ["ibx_01jc..."]}
GET /v1/audit
GET /v1/workspace/export
PATCH /v1/workspace/retention {"retention_days": 90}# One person, several workspaces: list the ones you belong to (signed in)
GET /v1/me/workspaces
# A signed in session picks one with a header. An API key always
# acts in the workspace that made it.
Runearc-Workspace: org_01jc...
# Each workspace has its own plan, members, domains, inboxes and keys.Every workspace gets a private runearc.email domain with a Catch-all inbox, so you can try things before adding your own domain.
Who it is for
Pick the page closest to what you are building.
Limits, honestly
What it does not do, so you can decide before you start.
- The plan belongs to the workspace. The free plan has 3 inboxes, 3,000 emails a month and 3 domains in total.
- There is no billing per domain or per inbox, and no invoices per client inside one workspace. Use a workspace per client for that.
- There is no single sign-on and no white-label dashboard.
- Inviting people, reading the audit log and exporting need you signed in. An API key cannot do them.
- A key belongs to one workspace and cannot move to another.
- Only the workspace owner can export data or change how long mail is kept. Mail is kept until you delete it unless you set a limit.
- The audit log is kept for 400 days unless you change it.
Questions
What is in a workspace?
Everything: the plan, the people, the audit log, and your domains, inboxes, keys, webhooks, mail and contacts. One person can belong to several workspaces and switch between them.
Who can see what?
Owners and admins see everything. A member gets a role, Admin, Developer, Support or Viewer, and you can limit them to certain inboxes. A Billing member sees billing and no mail.
Should each client get its own workspace?
If their mail, teammates or bills must stay apart, yes. Each workspace has its own plan. If you only want separate domains and keys, one workspace with a sending key per domain is enough.
Can I take my data with me?
Yes. The owner can export the workspace as an NDJSON file, which is one JSON record per line. Key hashes and other secrets are left out.
Try it on the free plan.
The free plan has 3 inboxes, 3,000 emails a month and 3 custom domains. No card needed.