# For partners (OEM guide)

Written for PVS and practice-management software vendors that want Werkmail as their embedded, white-labelled communication layer — not for individual practices. If you are a practice, start at [Getting started](/getting-started).

The marketing pitch for this program: [werkmail.eu/partners](https://werkmail.eu/partners).

## White-label options

- **Transactional footers** can carry your brand instead of a Werkmail attribution on the plans that allow it.
- **Sender domains** are authenticated per workspace with SPF, DKIM, and DMARC, so mail goes out from the customer's own domain — not from a shared one.
- See [Raw source and branding](/raw-source-and-branding) for exactly what can be branded in the message source (Message-ID, DKIM, relay headers) and what cannot.

## Multi-workspace provisioning via API

Creating a workspace programmatically is possible today:

```
POST /api/practices
```

Partner-level tooling — provisioning a workspace per customer at scale, with per-customer billing and onboarding defaults — is **planned** and not yet available. Flag this to your sales contact if you need it before launch; the endpoint contract above is the intended base.

## Recommended integration pattern

Your app should **never see a Werkmail token directly**. The pattern that keeps credentials safe and evidence audit-clean:

1. **Your backend holds the credentials.** Scoped team or project tokens live server-side, with the least privilege your integration needs.
2. **Your app calls your backend.** Compose, send, and webhook handling go through your API, which attaches the Werkmail credentials.
3. **Werkmail keeps the evidence.** Consent, delivery, and audit events stay in the customer's tenant workspace — exportable whenever a DPO asks.

This keeps token rotation and scoping under your control, and it means the customer's evidence trail is not scattered across client devices.

## Evidence your customers can export

- [Compliance evidence](/compliance-evidence) — consent ledger fields, audit export, DSAR export
- [HTTP API](/api) — authentication and endpoint map
- [Webhooks](/webhooks) — delivery and suppression events for your integration

## What stays in scope

Werkmail stays a focused communication and evidence layer. It does not replace your PVS, and it will not build the full marketing-automation cloud — see [Campaigns](/campaigns) and [Journeys](/journeys) for the deliberately "good enough" scope.