# Your first send (/guides/first-send)

Every Bitelio send normally comes from a domain you have verified, and verifying one means editing
DNS. That is the right rule for production and the wrong first step for an evaluation, so there is
one address you can send from immediately.

<Callout type="warn">
  The shared test sender proves **your code works**. It does not prove your deliverability. The mail
  leaves a domain that is not yours, so it exercises none of your SPF, your DKIM or your sending
  reputation. Verify your own domain before you send anything to a real recipient.
</Callout>

## Send one

Create a secret key with the `email:send` scope (**Settings → General → API Keys**), then:

```bash
curl https://api.bitelio.com/v1/send \
  -H "Authorization: Bearer $BITELIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "onboarding@send.bitelio.com",
    "to": "you@yourcompany.com",
    "subject": "Hello from Bitelio",
    "body": "<p>It works.</p>"
  }'
```

`to` has to be **your own address** — see below. Any local part works on the sender side, so
`support@send.bitelio.com` and `noreply@send.bitelio.com` are equally valid while you are trying
things out.

## What it will and will not do

**It writes only to members of your project.** The recipient has to be someone with an active
membership and a verified email address — in practice, you and your teammates. Anything else is
refused.

That restriction is the reason the shared sender can exist at all. A domain that anyone could send
from to anywhere would be an open relay carrying Bitelio's sending reputation, and the cost of
someone abusing it would fall on every other customer.

**Fifty sends a day, per project.** Enough to debug a flow. If you are hitting it, you have stopped
evaluating and started using it, which is the moment to verify your own domain.

**No campaigns, and not as a template's From address.** Both go to lists rather than to a known
recipient, so neither can satisfy the rule above. A campaign **test send** does work — it already
requires the recipient to be a project member.

## Then verify your domain

Nothing above changes once you do, and everything above stops mattering: your own domain has no
recipient restriction, no daily cap, and it is the only way to find out whether *your* mail arrives.

<Cards>
  <Card title="Verifying domains" href="/guides/verifying-domains">
    Add a domain, publish its records, and send from your own address
  </Card>

  <Card title="API keys" href="/guides/api-keys">
    Scope a key to exactly the slice of the API an integration needs
  </Card>
</Cards>