Connecting the plugin

You do not have to create an API key by hand. In WordPress, go to Settings → SendBeam, tick what you want the site to be able to do and press Connect SendBeam. A window opens on sendbeam.io, you sign in (or create an account there and then), you approve the list, and the window closes with the site connected.

What happens when you press Connect

1. A window opens on sendbeam.io. It is a window, not a frame inside your site — so you can see the address bar and the certificate before you type a password. Nothing on your site can read it.
2. If you have no account yet, you get the ordinary signup: your email, a workspace name (your site's name, filled in for you), a password, and a code sent to your inbox to prove the address is yours.
3. You see one line for each thing the site asked for, and a workspace to connect it to if you have more than one. Untick anything you do not want. Showing your forms stays on: nothing in the plugin works without it. The sending-domain line has a box with the domain your email will come from — see below.
4. Press Connect. SendBeam creates an API key for that workspace, named WordPress · your site name, carrying exactly what you approved, and hands it to your site's server. The key never travels through the browser and is never shown on screen.
5. The window closes and the plugin says Connected, with a checklist of what is left to do.

Pressing Cancel creates nothing at all, and the plugin is told you said no.

Choosing the domain your site sends from

The box on the sending-domain line starts with your site's own address, without the www. — but it is only a suggestion, and you can type anything you own over it. A subdomain such as mail.yourdomain.co.uk works, and so does a different domain altogether if your email should come from your brand rather than from the site's address. Whatever you enter is the domain the records are for, the one the plugin shows you, and the one your site's email is signed by.

If your site is on a hosting company's own domain — anything ending in wordpress.com, myshopify.com, netlify.app, an address like 203.0.113.10, and so on — the line is offered switched off, and the box starts empty. Mail cannot be sent from a domain somebody else runs: you cannot add DNS records to it, so it could never verify. Enter a domain you own, or leave the line unticked and skip the step; you can connect again later when you have one.

What Connect sets up for you

A key on its own is not a working setup. Before one email can leave your site you need a sending domain, a list, a form and a from name — four screens, in an order nobody tells you. So approving the connection does the parts it can do, and the plugin shows you what is left:

• Your sending domain. If you left Set up this site's sending domain ticked, the site's own domain is added to the workspace with its DNS records, ready to verify. See below.
• A list and a signup form. A workspace with no signup form gets a list called Subscribers, with double opt-in on, and a form called Newsletter signup that fills it. If you already have a form, nothing is created — the plugin offers the one you have.
• A from line. A workspace with no sender name takes the site's name, and one with no sender address takes hello@ the domain you chose. Anything you have already chosen is never changed. Sending from that address still waits for the domain to verify.

Nothing here overwrites a decision you have made. Connecting a second time replaces that site's key rather than adding another, so you never have to work out which of four keys belongs to which site.

Verifying your sending domain

Email sent from your own domain has to be signed by it, and that means adding a handful of DNS records at whoever holds your domain name. The plugin lists exactly the ones yours needs, each with a Copy button, so nothing is typed by hand.

• If your registrar supports automatic set-up, the plugin shows Set up DNS automatically. It opens your registrar, you sign in there and approve the records, and it brings you back to WordPress — to the same page you pressed the button on, with the check already running. You do not end up on a SendBeam settings page.
• Otherwise, add the records at your registrar and press Check now. DNS takes a few minutes to spread; SendBeam also re-checks on its own, so the step ticks itself in the end even if you walk away. Check now is limited to a dozen presses an hour — if you reach it, the plugin says how long to wait, and nothing is lost by waiting.
• Each record has its own tick. A record that has been found says so; one that has not been checked yet says that instead of pretending it is wrong. Two of three records right is progress, and it is worth being able to see which one is left.

Until the domain is verified, the plugin will not switch your site's email over to SendBeam, even if you granted that permission. A site whose mail is routed through an unverified domain is a site whose password reset emails stop arriving, and that is not a thing to find out about afterwards.

What each permission allows

• Show your forms on the site — the plugin can list and display the forms in that workspace (forms:read). Always on.
• Add people who tick an opt-in box at registration, in comments or at checkout — the plugin can create and update contacts, put them on the list you choose and tag them (contacts:read, contacts:write, lists:read, lists:write, tags:read, tags:write). It cannot download your audience: exporting is a separate permission the plugin never asks for.
• Send the site's own email through SendBeam — password resets, order emails and notifications go out from your verified sending domain (transactional:send). See Site email.
• Send WooCommerce order, cart and product events — the store can report events that drive the e-commerce automation triggers (ecommerce:read, ecommerce:write). See E-commerce events.
• Set up this site's sending domain — the domain you enter on that line is added to the workspace when you connect, and afterwards the plugin can read whether it has verified and which records are still missing (domains:read). Read-only: the plugin can never add, remove or change a domain later, and it cannot see anything else under Settings.

Nothing here lets the site send a campaign to your audience: that permission is not part of a connection and has to be chosen deliberately on a key you make yourself.

One key per site

Every connection makes its own key, in one workspace. Connect a second site and it gets a second key, so one site can be cut off without disturbing the other, and the Last used column under Settings → API keys tells you which sites are still live. Connecting the same site again replaces that site's key rather than adding another.

A key belongs to the workspace you chose in the window, and it can never read or write another one. If you picked the wrong workspace, connect again and choose the right one — the old key is revoked for you.

Reconnecting

Connecting again is how you change your mind: tick a permission you left off, move the site to another workspace, or send from a different domain. The plugin offers Reconnect on the connected card, and Reconnect with more permissions on any step that is waiting for one you did not grant.

A reconnection replaces: the site's previous key is revoked as the new one is made, matched both by its name and by the domain it was connected for, so renaming the site in WordPress or changing the sending domain cannot leave a second live key behind. Nothing else in the workspace is touched.

Disconnecting

Press Disconnect on the plugin's own page. The site tells SendBeam to revoke its key, then forgets it, along with the settings the connection itself filled in.

Disconnecting revokes this site's key. Your sending domain, list, form and sender stay in the workspace; other sites sending from the same domain are unaffected. Nothing is deleted anywhere, so connecting the site again later picks up exactly what is already there.

Deleting the plugin without disconnecting leaves the key alive. If that has already happened — or if the plugin could not reach SendBeam when you pressed the button, which it will tell you — go to Settings → API keys, find the key named after the site and revoke it there.

If something goes wrong

• The window says the link is not complete. The request from your site was missing something, or its return address was not on the same site. This happens on a site whose address is not https. Fix the site's address in WordPress and try again.
• It says you need an admin seat. Only a workspace admin can create a key. Ask an admin to connect the site, or to give you the admin role under Settings → Team.
• The plugin says the connection expired. The handover is good for ten minutes and works once. Press Connect again.
• Pop-ups are blocked. Allow pop-ups for your own site's admin area and press Connect again — the window is where you type your password, so it is never put inside the page.
• It says that is not a domain name. The sending-domain box wants the domain on its own — harbourlane.co.uk, not https://harbourlane.co.uk/ and not an email address. Nothing was connected; correct it and press Connect again.
• The plugin says the domain was not set up. It also says why: a domain your hosting company owns cannot be used, and a plan at its limit of sending domains says so. Everything else about the connection still worked.

You can still connect the old way: make a key under Settings → API keys and paste it into the plugin. See the plugin overview.