CORS and browser apps

Why you shouldn't call the Delivrie API from the browser, and how to send email from React, Vue, mobile and no-code front ends through a small server route instead.

If you call https://delivrie.io/api from code that runs in a browser or mobile app, anyone can open developer tools, copy your API key and send email as you. So keep the key on a server.

Send through a server route

Put the API call in code you control on the server, and have your front end call that:

app/api/contact/route.ts (Next.js)

import { Delivrie } from "delivrie";

const delivrie = new Delivrie(process.env.DELIVRIE_API_KEY);

export async function POST(req: Request) {
  const { email, message } = await req.json();
  if (!email || !message) return Response.json({ error: "Missing fields" }, { status: 400 });

  const { error } = await delivrie.emails.send({
    from: "Website <forms@mail.acme.com>",
    to: "team@acme.com",
    replyTo: email,
    subject: "New message from the website",
    text: message,
  });
  return error ? Response.json({ error: error.message }, { status: 502 }) : Response.json({ ok: true });
}

Front end

await fetch("/api/contact", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email, message }),
});

Good places for that server code: a Next.js route handler or Server Action, a Supabase Edge Function, a Cloudflare Worker, a Vercel or Netlify function, Firebase Cloud Functions, or your own backend.

Protect the route

A public route that sends email can be abused too. Before sending:

No-code and AI app builders

Lovable, Bolt, v0, Replit and similar tools can generate the server route for you. Ask them to "send email from a server function using the Delivrie API, reading DELIVRIE_API_KEY from secrets, never from the browser". See Build with AI for prompts.

More guides