Documentation

BlitzMail is a private email API for BlitzCore members. You register with a key pass, create API keys, and send mail through Resend and Brevo without exposing provider secrets.

Base URL

Configure NEXT_PUBLIC_API_URL in the web app. Default local API:

https://bcmail.hostless.app

Production sending host (example):

https://bcmail.bcr.com.ng

Authentication

Session JWT — after login/register. Used for dashboard routes (/api/keys, /api/auth/me).

API key — created in the dashboard. Used only for POST /api/send. Header:

Authorization: Bearer bm_xxxxxxxx...

Send an email

POST /api/send
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "from": "otp@mail.bcr.com.ng",
  "to": "user@example.com",
  "subject": "Your verification code",
  "html": "<p>Your code is <strong>482193</strong>.</p>",
  "text": "Your code is 482193.",
  "replyTo": "support@mail.bcr.com.ng",
  "provider": "resend"
}

from must use mail.bcr.com.ng or mail.blitzcore.com.ng
Provide at least one of html or text
provider is optional (resend | brevo). Default: Resend, then Brevo fallback

Recommended From addresses

Address	Use
otp@mail.bcr.com.ng	One-time codes
verify@mail.bcr.com.ng	Email verification links
updates@mail.bcr.com.ng	Product updates / news
announce@mail.bcr.com.ng	Announcements
noreply@mail.blitzcore.com.ng	System / generic

Other endpoints

Method	Path	Auth
GET	/ping	None
POST	/api/auth/register	Key pass in body
POST	/api/auth/login	None
GET	/api/auth/me	Session JWT
GET/POST/DELETE	/api/keys	Session JWT
POST	/api/send	API key

Getting access

Ask a BlitzCore admin for a key pass (format BP-XXXX-XXXX). Only 30 passes exist in total. Register at /register, then create an API key under API Keys.