PostLine is a developer-focused Email API designed to make sending transactional and marketing emails straightforward, reliable, and cost-effective. Built with Next.js 15, PostgreSQL, and Prisma, the platform allows developers to register, create API keys, configure sender addresses, and send emails via a simple JSON REST API.The application features a monotone black-and-white UI using shadcn/ui and Aceternity components, subscription tiers managed by Razorpay, and a secure credential vault for custom SMTP setups.
Technical Architecture
1. Delivery Engine & Fallbacks
PostLine acts as an abstraction layer above physical email delivery services:
Resend Integration: Used by default to dispatch transactional emails (like user verification and password resets).
Gmail OAuth Flow: Allows users to link their personal or workspace Gmail accounts via OAuth, sending emails through Google's SMTP servers under their own domain.
SMTP Vault: For users who prefer their own custom SMTP servers. The host, port, username, and password are encrypted at rest in the database before storage.
2. Secure API Key Authentication
Developers authenticate their API requests by passing an API key in the authorization header. The key validation process is handled via custom Next.js middleware:
When a request hits /api/v1/send, the middleware extracts the key.
It hashes the key using SHA-256 and queries the Postgres database to find a matching hashed key (preventing plain-text API keys from being exposed if the database is compromised).
It verifies that the key has the correct scopes (e.g., send:transactional) and is within the account's active monthly quota limits.
3. Razorpay Subscription & Webhook Pipeline
Billing is handled via Razorpay subscriptions:
Tiers: Free, Developer, Startup, and Enterprise, each mapping to a specific monthly email quota.
Webhook Sync: Razorpay notifications (like subscription.charged, subscription.cancelled) are received by a Next.js API route. The route validates the signature of the webhook payload using the Razorpay secret key, then updates the user's subscription status and resets their email quota counters in the database.
SMTP Credential Security: Storing SMTP passwords in plain text is a massive security risk. To solve this, I implemented database-level encryption. The credentials are encrypted using AES-256-GCM before writing to PostgreSQL, using an encryption key stored as a secure environment variable on the server.
Webhook Reliability: Webhooks can fail if the server is down or slow. I built a resilient webhook endpoint that immediately stores the raw Razorpay payload in a WebhookQueue table, sends a 200 OK back to Razorpay, and processes the queue asynchronously in a background worker. This prevents timeouts and ensures no billing updates are lost.
