Skip to main content

​
Protocol addresses

The Mail API uses api.webdock.dev; https://auth.webdock.dev/api/mail/v1 remains a compatible alias for existing clients. Both hosts use the same keys, quotas and idempotency state, without redirecting requests. The browser moved to Console. Registered OAuth callbacks, the MCP resource audience and legacy bearer API addresses remain protocol identities. Do not substitute the Console hostname in token requests.

​
OAuth clients

Register a client in Connections. Use the exact callback URL supplied by your client. Public/native clients use PKCE without a secret; confidential server clients can use a client secret. Dynamic anonymous registration is disabled. Consent and granted scopes limit the token. The server also checks current session, account and resource permissions. Disabling the client or signing out can invalidate access before nominal token expiry. Clients explicitly enabled for remote renewal can request offline_access. Store refresh tokens in the client’s credential store, serialize renewal, and replace a token after rotation. Reconnect when the session or refresh grant expires.

​
Mail keys

Mail uses its own bearer keys, created for a workspace and connection. sending_access supports sending; full_access permits the broader Mail API subject to resource restrictions. Restrict the sender domain where possible. A provider credential is not a Webdock Mail API key.
Never place a Mail key, OAuth client secret or private CMS bridge credential in browser code, a public repository or a documentation example.