MagicMail
Strapi plugin · email delivery

Email accounts and delivery, managed in Strapi.

Magic-Mail is a Strapi 5 plugin for managing email accounts, routing rules, templates, and delivery analytics. It handles email only.

Install the plugin View source
Strapi ^5.57.0 Node.js 20.19 to 26.x MIT

Features

Magic-Mail provides email account management and delivery tools in the Strapi admin.

Email accounts and routing rules

Configure email accounts and route messages using the plugin's routing rules. Supported account setup includes Gmail, Microsoft 365, Yahoo, SMTP, SendGrid, and Mailgun.

Templates and analytics

Create email templates, keep template versions, and review email delivery logs and analytics.

OAuth account setup

Start Gmail, Microsoft, and Yahoo account authorization from the admin interface.

Email only

The plugin exposes email sending and tracking. WhatsApp transport and its connection state belong to the separate Magic-WhatsApp plugin.

Install

The package declares Strapi ^5.57.0 as a peer dependency and requires Node.js >=20.19.0 <=26.x.x.

Terminalnpm
npm install strapi-plugin-magic-mail
npm run build

Enable the plugin in your Strapi configuration:

config/plugins.ts
export default () => ({
  'magic-mail': {
    enabled: true,
  },
});

Configuration

After enabling the plugin, open MagicMail in the Strapi admin to add an email account and configure routing rules, templates, and plugin settings.

Enter OAuth provider credentials when you add an account in the admin. In production, set MAGIC_MAIL_ENCRYPTION_KEY to a secret of at least 32 bytes. Keep it stable: changing the key makes previously stored account credentials unreadable.

See the README setup guide for provider-specific configuration and callback URLs.

Security and permissions

Admin API routes require an authenticated Strapi administrator with the plugin::magic-mail.access permission.

  • Email send routes use Strapi Content API authentication, validate request data, and share a per-caller in-memory rate limit of 60 requests per minute.
  • OAuth callback routes are public because providers redirect to them. The callback flow checks signed, single-use state.
  • Open and click tracking routes are public for email-client compatibility and have a separate in-memory rate limit.
  • Rate-limit counters are local to each server process, not shared across multiple Strapi instances.

API

Content API routes use the /api/magic-mail prefix.

MethodPathPurpose
POST/sendSend an email through the Magic-Mail router.
POST/send-messageSend an email using the message endpoint.
GET/track/open/:emailId/:recipientHashRecord an email open.
GET/track/click/:emailId/:linkHash/:recipientHashRecord a tracked click and redirect.

Admin routes cover accounts, OAuth setup, routing rules, templates, analytics, and plugin settings. They require the admin permission described above. See the route definitions and README for details.

Releases and testing

Releases use semantic-release on pushes to main. Conventional Commits determine version changes. The release workflow runs tests, builds the plugin, verifies its exports, then publishes the npm package.

Release history npm package Source and issue tracker
Local checks
npm ci --legacy-peer-deps
npm test
npm run build
npm run verify