# Getting started

This guide takes you from an empty workspace to an authenticated sending domain and a first API send.

## 1. Create a workspace

1. Open [https://werkmail.eu/login](https://werkmail.eu/login) and request a one-time sign-in code.
2. Create a workspace (internally called a **practice** / tenant).
3. Complete onboarding: sending domain, DNS, Impressum for marketing, and a test send.

Each workspace is an isolated sending tenant. Reputation, suppressions, and API tokens do not leak across workspaces.

## 2. Authenticate a sending domain

Add the domain you will send **From**. Werkmail asks the outbound platform to verify that domain identity and issues DKIM CNAMEs.

Publish, at minimum:

- **DKIM** CNAMEs on the sending host (DNS-only if you use a proxied DNS dashboard — do not orange-cloud DKIM).
- **SPF** TXT on the sending apex (include the platform include).
- **MAIL FROM** (`bounce.<domain>`) so SPF can align.
- **DMARC** TXT on `_dmarc.<apex>` (and `_dmarc.<subdomain>` if you send From a subdomain).

Cloudflare users can apply records in one click from onboarding (API token or Domain Connect). You can also export a BIND zone.

Details: [DNS and authentication](/dns-and-authentication).

## 3. Pick a route and a message kind

| You are sending | Route | `message_kind` |
| --- | --- | --- |
| Appointment, invoice, password reset | `outgoing` | `termin`, `transactional`, or `recall` |
| Newsletter or campaign | `broadcast` | `newsletter` |
| Double opt-in confirm | `outgoing` | `doi` |

Marketing on `outgoing` is rejected. Clinical kinds on `broadcast` are rejected. See [Concepts](/concepts).

## 4. Send from the dashboard

Open **Emails → Compose**, choose the route, preview inbox risk (`POST …/send/score`), then send. Every message gets a List-Unsubscribe header when the public origin is HTTPS.

## 5. Send from the API

Create a **project token** (`wm_proj_…`) under Settings → API tokens, or use your session bearer.

```bash
export BASE="https://werkmail.eu"
export TOKEN="wm_proj_…"
export PRACTICE_ID="your-workspace-uuid"

curl -sS -X POST "$BASE/api/practices/$PRACTICE_ID/send" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: first-send-001" \
  -d '{
    "from": "Praxis <noreply@your-domain.example>",
    "to": ["you@example.com"],
    "subject": "Hello from Werkmail",
    "text": "Plain text body",
    "html": "<p>HTML body</p>",
    "route": "outgoing",
    "message_kind": "transactional",
    "tag": "onboarding"
  }'
```

A successful send returns **202**:

```json
{ "message_id": "…", "id": "…", "status": "queued" }
```

Full field list: [Send API](/api/send).

## 6. Watch delivery

- Dashboard: **Emails → Messages** (search + timeline).
- API: `GET /api/practices/{id}/messages/{messageID}` and `…/timeline`.
- Your systems: [signed webhooks](/webhooks).

## Next

- [Compliance](/compliance) — DOI, Impressum, unsubscribe.
- [Deliverability](/deliverability) — warm-up, reputation guardrails, content gate.
- [Raw source and branding](/raw-source-and-branding) — what View Source shows after send.
- [Inbound](/inbound) — receive mail on `in.<domain>` only.