Getting started with the sandbox

Every new workspace starts in a sandbox. Mail goes only to addresses you have verified. This protects your sender reputation and everyone else's: a fresh domain that sends to a cold list lands in spam on the first day. The sandbox makes you build a clean record first.

1. Redeem your access code

If you received an access code (for example as a prize), enter it on the sign-up form together with your email address. You get an account link by email. The plan that comes with the code is attached to your workspace automatically.

Time-limited plans end on the date shown in Settings, Billing. You get a reminder 14 days before. After the end date the workspace returns to the Starter plan and nothing is billed. A printable certificate is available from the same card.

curl -X POST https://app.example.com/api/public/access/redeem \
  -H "Content-Type: application/json" \
  -d '{"email": "you@your-domain.example", "code": "WM-XXXX-XXXX-XXXX"}'

2. Connect your own domain

A workspace created from an access code needs a sending domain you own, for example mail.your-domain.example. Publish these records at your DNS host, then run Check DNS:

See DNS and authentication for the exact values.

3. Complete your Impressum

Open Settings, Legal and fill in the legal name, postal address and privacy policy URL. This is required before any marketing mail.

4. Follow the first-send guide

Open Domains, Go live. The guide at the top shows the next step and moves on by itself:

1. Add an address you own. It gets a confirmation link; until you open it, the address cannot receive mail from the workspace. You can add up to 10.
2. Verify the sending domain if that is still open.
3. Press Send test email. You watch the message go from sent to delivered, and the counter moves up by one.
4. Repeat until the counter reaches 20.

The mailbox simulator addresses are always allowed for functional tests, but they do not count toward the clean deliveries.

If a test mail bounces or is reported as spam, the guide explains why. A bounce or complaint blocks the request for 7 days, then it no longer counts, so a typo in an address does not lock you out.

5. What the checklist needs

• 20 deliveries to your confirmed addresses
• no bounces and no complaints in the last 7 days
• DKIM, MAIL FROM, DMARC and Impressum complete

6. Request production access

When the checklist is complete, describe your use case, where your list comes from, how recipients opted in, and your expected monthly volume. A person reviews the request. You receive the decision by email, with a reason if it is not approved. You can submit again after fixing the points.

7. Warm up

After approval the workspace leaves the sandbox and the warm-up starts at day 0 with a low daily cap that grows each day. Broadcast sends unlock after warm-up day 3. Bounce and complaint spikes pause sending automatically.

Keep your list clean

• Send only to people who opted in, ideally with double opt-in.
• Never use bought or scraped lists.
• Remove hard bounces and unsubscribes immediately. Werkmail suppresses them automatically.
• Start with your most engaged recipients and grow the volume slowly.
• A fresh domain has no reputation. Even a clean first month can show spam-folder placement at some providers. Check the inbox-risk preview before each campaign and read Deliverability.

Operators

Platform admins manage codes, bulk provisioning, prize grants and the review queue through the admin API. Use a placeholder token in scripts and never paste a live one into a ticket.

# Create a code: 12 months of the Agency plan for up to 9 teams
curl -X POST https://app.example.com/api/admin/access-codes \
  -H "Authorization: Bearer $ADMIN_API_TOKEN" -H "Content-Type: application/json" \
  -d '{"label": "Hackathon 2026", "plan": "agency", "plan_months": 12, "max_redemptions": 9}'

# Provision addresses against a code
curl -X POST https://app.example.com/api/admin/access-codes/$CODE_ID/provision \
  -H "Authorization: Bearer $ADMIN_API_TOKEN" -H "Content-Type: application/json" \
  -d '{"emails": ["team-a@example.org", "team-b@example.org"]}'

# Give winners a time-limited plan
curl -X POST https://app.example.com/api/admin/prize-grants \
  -H "Authorization: Bearer $ADMIN_API_TOKEN" -H "Content-Type: application/json" \
  -d '{"grants": [{"email": "winner@example.org", "plan": "agency", "months": 12, "label": "Hackathon 2026, 1st place"}]}'

# Review requests
curl -H "Authorization: Bearer $ADMIN_API_TOKEN" "https://app.example.com/api/admin/production-access?status=pending"
curl -X POST https://app.example.com/api/admin/production-access/$REQUEST_ID/decide \
  -H "Authorization: Bearer $ADMIN_API_TOKEN" -H "Content-Type: application/json" \
  -d '{"approve": true}'