.png){kind=logo}
Overview
What the MailEditor Plugin is, how the pieces fit together, and which credentials go where.
The MailEditor Plugin puts the MailEditor drag & drop email builder inside your own product. Your users design emails in an iframe on your page, and everything they create is stored on MailEditor, scoped to the user id you provide.
You manage each embed from Settings → Plugins in the MailEditor dashboard: name, logo, allowed domains, visible blocks, an optional AI key, optional stock photo keys, an optional storage bucket, and the plan.
How it fits together
| Party | What it does |
|---|---|
| Your dashboard on MailEditor | Creates the plugin, holds its credentials, and decides what the editor shows. |
| Your server | Signs the identity of the current user and reads saved templates back through the Backend API. |
| Your page | Renders an <iframe> pointing at the editor with the signed identity in the URL. |
The editor inside the iframe talks to MailEditor on its own: it opens a session, keeps it alive while the page is open, and closes it when the page unloads. Your code never calls those endpoints.
Your dashboard ──── plugin_id + plugin_secret ────► Your server
│ signs external_user_id
▼
Your page ──── <iframe src="…/plugin-editor/v1/{plugin_id}?…"> ────► MailEditor editor
│ session, templates, images
▼
Your server ◄──── Backend API (X-Plugin-Id + X-Plugin-Secret) ──── MailEditorTwo credentials
| Credential | Where it lives | What it is for |
|---|---|---|
| Plugin ID | Public. Appears in the iframe URL. | Identifies the plugin. |
| Plugin Secret | Server only. Never in a browser. | Signs end-user identities and authenticates the Backend API. |
Keep the secret on your server
A secret sent from a browser is refused, whether or not it is correct.
What you need before you start
- A MailEditor account with access to Settings → Plugins.
- A plugin. See Create a plugin.
- Your page's domain on the plugin's allowed domains. Add
localhost:3000(or your port) for local development. - A server-side route that signs a string with the plugin secret. See Identity signing.
What the plugin does not do yet
- There is no JavaScript SDK and the iframe sends no events to your page. Read saved work with the Backend API.
- Templates cannot be deleted through the API.
See Limits and roadmap.