Engineering note
Why verification comes before agent sending
An API key can be issued immediately without granting an anonymous caller outbound mail.
Provisioning and permission are separate
Self-service signup creates an agent address and returns an API key. That key can be used to create an inbox and read mail, but it does not by itself authorize outbound email. DakNode sends a one-time code to the signup mailbox. Only a successful verification removes the account-unverified sending restriction. A person who never receives the code cannot use repeated signup calls as a route to tenant sending.
The verification email is platform mail from DakNode, not a message sent on behalf of the new tenant. That distinction matters: a tenant has not yet established a basis to email a recipient, while the platform is contacting the mailbox named in the signup request about that signup. The code is minted and sent by the worker; it is not carried as a queue argument or returned by the signup API.
Verification is not consent to receive tenant mail
A one-time code proves access to one mailbox. It does not prove a person's legal identity, and it does not mean that mailbox has consented to marketing or to mail from every tenant on the platform. DakNode keeps those facts separate. Verification lifts the unverified-account restriction, while recipient consent, suppression, quota, and feedback-health checks still apply to actual sends.
The signup path is rate-limited and repeat attempts are bounded. Re-registering an unverified address rotates its key instead of giving a fresh guessing budget; a verified address cannot be taken over by a new anonymous signup. These rules protect both the address holder and DakNode's sending reputation. They are not a substitute for protecting the API key after it is issued.
A practical first run
Use a mailbox you control, sign up once, read the verification code, and verify before testing outbound mail. If you retry a request, use a new Idempotency-Key only when you intend a new send; reusing one replays the earlier outcome. The developer guide documents the current request shapes and the OpenAPI contract is authoritative for field names. No browser signup is required for the agent API.