Configure a MailerSend domain and scoped bearer token

MailerSend API tokens are generated for sending domains and can have different permissions. Establish the intended domain/environment before connecting the application; an account login or trial sender does not replace that configuration.

Prepare a least-privilege connection

1. Verify/authenticate the application sending domain using MailerSend’s dashboard instructions.
2. Create a token with the required email-sending permission and appropriate domain scope.
3. Store it server-side. The HTTP authorization model is Bearer authentication; SMTP relay uses its own documented setup.
4. Keep tokens used to administer inbound routes or inspect messages separate if the application does not need those privileges.

The general API reference explains tokens, permission errors, asynchronous status codes, and validation failures. Do not interpret every 403 as an expired token; the account or token may lack the requested capability.

Verify the exact operation

Run one controlled send after domain verification and inspect the request identifier/status and activity. A token successfully reading a domain resource may still be unauthorized to send email.

For trial/account restrictions, follow the documented approval process rather than rotating identities. Mailbox MX records need not change just to authenticate outbound delivery.

If MailKite receives replies while MailerSend sends, keep the receiving address and verifier explicit. Neither provider’s domain token configures the other’s infrastructure or suppression policy.