Connecting the plugin — Docs

You do not have to create an API key by hand. In WordPress, go to Settings → SendBeam, tick what you want the site to be able to do and press Connect SendBeam. A window opens on sendbeam.io, you sign in (or create an account there and then), you approve the list, and the window closes with the site connected.

What happens when you press Connect

A window opens on sendbeam.io. It is a window, not a frame inside your site — so you can see the address bar and the certificate before you type a password. Nothing on your site can read it.
If you have no account yet, you get the ordinary signup: your email, a workspace name (your site's name, filled in for you), a password, and a code sent to your inbox to prove the address is yours.
You see one line for each thing the site asked for, and a workspace to connect it to if you have more than one. Untick anything you do not want. Showing your forms stays on: nothing in the plugin works without it.
Press Connect. SendBeam creates an API key for that workspace, named WordPress · your site name, carrying exactly what you approved, and hands it to your site's server. The key never travels through the browser and is never shown on screen.
The window closes and the plugin says Connected, with a checklist of what is left to do.

Pressing Cancel creates nothing at all, and the plugin is told you said no.

What Connect sets up for you

A key on its own is not a working setup. Before one email can leave your site you need a sending domain, a list, a form and a from name — four screens, in an order nobody tells you. So approving the connection does the parts it can do, and the plugin shows you what is left:

Your sending domain. If you left Set up this site's sending domain ticked, the site's own domain is added to the workspace with its DNS records, ready to verify. See below.
A list and a signup form. A workspace with no signup form gets a list called Subscribers, with double opt-in on, and a form called Newsletter signup that fills it. If you already have a form, nothing is created — the plugin offers the one you have.
A from name. A workspace with no sender name takes the site's name. A name you have already chosen is never changed.

Nothing here overwrites a decision you have made. Connecting a second time replaces that site's key rather than adding another, so you never have to work out which of four keys belongs to which site.

Verifying your sending domain

Email sent from your own domain has to be signed by it, and that means adding a handful of DNS records at whoever holds your domain name. The plugin lists exactly the ones yours needs, each with a Copy button, so nothing is typed by hand.

If your registrar supports automatic set-up, the plugin shows Set up DNS automatically. It opens your registrar, you sign in there and approve the records, and you come back done.
Otherwise, add the records at your registrar and press Check now. DNS takes a few minutes to spread; SendBeam also re-checks on its own, so the step ticks itself in the end even if you walk away.

Until the domain is verified, the plugin will not switch your site's email over to SendBeam, even if you granted that permission. A site whose mail is routed through an unverified domain is a site whose password reset emails stop arriving, and that is not a thing to find out about afterwards.

What each permission allows

Show your forms on the site — the plugin can list and display the forms in that workspace (forms:read). Always on.
Add people who tick an opt-in box at registration, in comments or at checkout — the plugin can create and update contacts, put them on the list you choose and tag them (contacts:read, contacts:write, lists:read, lists:write, tags:read, tags:write). It cannot download your audience: exporting is a separate permission the plugin never asks for.
Send the site's own email through SendBeam — password resets, order emails and notifications go out from your verified sending domain (transactional:send). See Site email.
Send WooCommerce order, cart and product events — the store can report events that drive the e-commerce automation triggers (ecommerce:read, ecommerce:write). See E-commerce events.
Set up this site's sending domain — the site's domain is added to the workspace when you connect, and afterwards the plugin can read whether it has verified and which records are still missing (domains:read). Read-only: the plugin can never add, remove or change a domain later, and it cannot see anything else under Settings.

Nothing here lets the site send a campaign to your audience: that permission is not part of a connection and has to be chosen deliberately on a key you make yourself.

One key per site

Every connection makes its own key, in one workspace. Connect a second site and it gets a second key, so one site can be cut off without disturbing the other, and the Last used column under Settings → API keys tells you which sites are still live. Connecting the same site again simply makes a fresh key; revoke the old one when you do.

A key belongs to the workspace you chose in the window, and it can never read or write another one. If you picked the wrong workspace, revoke the key and connect again.

Disconnecting

Press Disconnect on the plugin's own page. The site tells SendBeam to revoke its key, then forgets it. That is the whole job: the key is dead, the site can no longer reach SendBeam, and your contacts, forms, domain and campaigns are untouched.

Deleting the plugin without disconnecting leaves the key alive. If that has already happened — or if the plugin could not reach SendBeam when you pressed the button, which it will tell you — go to Settings → API keys, find the key named after the site and revoke it there.

If something goes wrong

The window says the link is not complete. The request from your site was missing something, or its return address was not on the same site. This happens on a site whose address is not https. Fix the site's address in WordPress and try again.
It says you need an admin seat. Only a workspace admin can create a key. Ask an admin to connect the site, or to give you the admin role under Settings → Team.
The plugin says the connection expired. The handover is good for ten minutes and works once. Press Connect again.
Pop-ups are blocked. Allow pop-ups for your own site's admin area and press Connect again — the window is where you type your password, so it is never put inside the page.

You can still connect the old way: make a key under Settings → API keys and paste it into the plugin. See the plugin overview.