Never ship SMTP credentials in an app
Any credential you compile into an APK is public. Decompile, extract, abuse: that is the lifecycle of an SMTP password shipped in an app, and it ends with your domain on a blocklist.
So Android email is two different jobs. When the USER should send mail (feedback, share, contact), hand off to their own mail app with an Intent. When YOUR APP should send mail (receipts, alerts, resets), the send belongs on your backend, one API call away.
One POST, and the send is handled
val intent = Intent(Intent.ACTION_SENDTO).apply { data = Uri.parse("mailto:") putExtra(Intent.EXTRA_EMAIL, arrayOf("[email protected]")) putExtra(Intent.EXTRA_SUBJECT, "Feedback") } startActivity(intent)
For app-generated email, the client calls your backend and the backend makes the same one POST every other page on this guide shows. The key never leaves your server, and delivery events land on your webhook, not in the app.
Distribution logic applies to your agent tooling too: Codex and ChatGPT now install the email connection with one click through the OpenAI app store. The pattern is the same one you ship by: the store handles trust, the platform handles the work.
Full parameters, responses, and error codes live in the REST API docs and the API reference.
And the part no library gives you
The same account exposes an MCP server, so the agent writing your code can also run your email. Point Claude, Cursor, or Codex at api.nitrosend.com/mcp and it composes, previews, and stages sends, with a human approving every one. The API is for your code. The MCP is for your agent. One platform either way.
Every send comes back with a message ID, and delivery events follow on your webhook: delivered, opened, bounced. No dashboard required to know what happened.