What's new in February 2026

API Key Scopes Enforced On Every Endpoint

API key permissions are now checked on every API endpoint, where they used to have no effect.

Ten scopes cover sending, templates, domains, webhooks and projects. The full preset grants all of them, the sending-only preset grants only the send scopes, and a custom list of scopes is accepted too. A request the key has no permission for returns a 403 with insufficient_scope.

A sending-only key used to read templates or domains no longer can, so give any key that needs those reads full access or the matching scopes.

Create, Update And Delete Endpoints For Webhooks

Webhooks can now be created, updated and deleted through the API, not only in the app.

An update changes only the fields it sends: the name, the target URL, the auth type, the subscribed events or whether the webhook is active.

Account-Wide Events Endpoint With Typed Event Objects

The new GET /emails/events searches events across all of your emails instead of one message at a time, filtered by event type, recipient, date range and bounce class.

Each of the 18 event types, such as delivery, bounce, delay, click, open, spam complaint, unsubscribe and policy rejection, now returns its own fields. Events also include the browser, operating system and device read from the user agent, and location data. Opens that a mailbox provider loaded in advance are labelled as prefetched in the event log. The email list and detail responses now include from and to.

Substitution Data Accepts Arrays Of Objects For Loops

data on a send now accepts numbers, true/false values and arrays of objects, where it used to accept only a flat map of strings.

Order lines, itemised receipts and digest lists can now be looped over inside the email instead of being turned into one string before sending. Objects nested more than one level deep are rejected, and the error names the key that caused it.

curl -X POST https://app.lettr.com/api/emails \
  -H "Authorization: Bearer $LETTR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "orders@example.com",
    "to": ["jane@example.com"],
    "template_slug": "order-confirmation",
    "data": {
      "first_name": "Jane",
      "items": [
        { "name": "Keyboard", "qty": 1, "price": "89.00" },
        { "name": "Cable", "qty": 2, "price": "12.00" }
      ]
    }
  }'

Saving An Email Creates A New Version Instead Of A Draft

Saving an email now creates a new version, and the separate draft is gone.

The draft used to need a publish step, with a draft badge and a next-version indicator; all three have been removed. Merge tags are saved with each version, the update response names the version it created, and the editor can open any earlier version.

Sending Domains Usable Without Manual Approval

A new sending domain can now send straight away, where it used to stay pending until someone reviewed and approved it.

Problem domains are now blocked at send time instead. A send from a blocked domain fails with an error that says so, where it used to be accepted without one.

Templates Renamed To Emails In The App

What the app called templates is now called emails everywhere, and the API stays the same.

Required Flag For Merge Tags Per Email Version

A merge tag on an email version can now be marked required by clicking its badge, and required tags are highlighted.

Redesigned Version History That Keeps The Last Version

Version history has a new layout with clearer wording on what saving and publishing each do, and the last remaining version can no longer be deleted.

Previewing a version that isn't the live one is now marked in grey instead of a warning color, since looking at an old version is a normal thing to do.

Expired Google And GitHub Sign-Ins Return To The Login Page

A Google or GitHub sign-in that expired because the tab was left open now returns to the login page with a message to try again, instead of an error.

A very long avatar URL from the provider can also no longer stop the account from being created.

Password Changes Sign Out All Other Sessions

Changing your password now signs you out of Lettr on every other device and browser.

User and team names are also stripped of markup when saved, so a name can't carry code into an email or a page.

API Reference Updated For Email Detail And All Event Types

The API reference no longer lists paths and schemas that were removed, documents the email detail endpoint properly, and describes every event type.