Sendblue: an iMessage API on Mac minis and iPhones since 2020, with its endpoints, limits and prices

Authentication and base URL

Every request carries two headers, sb-api-key-id and sb-api-secret-key, against https://api.sendblue.com (the older host api.sendblue.co still answers). Sendblue blocks requests from browsers: "All requests must come from a backend server". Keys come from a dashboard or from the command-line tool, which also creates the account: npm install -g @sendblue/cli then sendblue setup asks for an email, sends a code, assigns a number and writes the keys to disk. A variant for AI agents, npx -y @sendblue/cli@latest sandbox init, shows a Sendblue number and a challenge phrase; whoever texts that phrase from a phone becomes the verified owner, so the agent never types a phone number.

The endpoints

Sendblue's core surface, from its own index on 2026-09-21: POST /api/send-message (one recipient; fields number, from_number, content, media_url, status_callback, send_style), POST /api/send-group-message, POST /api/send-typing-indicator, POST /api/send-reaction, POST /api/mark-read, POST /api/send-carousel (2 to 20 images), GET /api/evaluate-service (does this number take iMessage), POST /api/upload-file and POST /api/upload-media-object, GET /api/v2/messages, full contact CRUD at /api/v2/contacts with opt-out and block, webhook CRUD at /api/account/webhooks, GET /api/lines, POST /accounts/lines/add-line, and POST /facetime/start-call. Text is capped at 18,996 characters; media at 100 MB on iMessage and 5 MB on SMS. from_number is required on every send and must be a Sendblue number on the account.

Statuses run REGISTERED, PENDING, QUEUED, ACCEPTED, SENT, DELIVERED, with DECLINED and ERROR as terminal failures. Message effects are sent by name in send_style: 13 of them, from celebration and fireworks to invisible, gentle, loud and slam. A .caf audio file renders as an inline voice note; a .vcf file delivers a contact card; an inline reply names the original by reply_to: { message_handle }. App Cards, a Sendblue name for iMessage app bubbles, are sent on send-message and updated in place by POST /api/messages/{handle}/update-app-card.

Webhooks

Seven webhook types exist: receive, outbound, typing_indicator, call_log, line_blocked, line_assigned and contact_created. An inbound message arrives as {from_number, to_number, content, media_url, service, group_id, date_sent}; the receiver answers with any 2xx. Media URLs expire after 30 days. Webhooks are signed with a secret and must be served over HTTPS. call_log fires only for outbound calls placed from the dashboard.

Limits

Sendblue's published limits on 2026-09-21: 1 message per second per dedicated number; the AI Agent plan allows 1,000 inbound contacts per day per line on a rolling 24 hours and 200 follow-ups per day per line; the Blue Ocean outbound plan allows 50 new outbound contacts per day per line, 15 per hour, and 5 messages to a contact who has not replied; the send queue holds 1,500 messages and returns 429 beyond that; iMessage detection is limited to 30 checks an hour and 100 a day per line; the contacts API to 100 requests per 10 seconds. Opt-out words (stop, unsubscribe, cancel, opt out, revoke, end, quit) are detected on every plan.

Plans and prices

From sendblue.com/pricing on 2026-09-21: Free at $0, a shared line for prototyping with no outbound to unverified contacts and no webhooks; AI Agent at $100 per dedicated line per month, "inbound-first" with 1,000 inbound contacts a day, webhooks, media, typing and reactions, unable to start a conversation with a contact who has not texted first; Blue Ocean and Enterprise at custom, volume-based prices for full outbound, multiple lines, SOC 2 and HIPAA terms and an account manager. No per-message fee, no A2P registration, no carrier surcharge, and international messaging included; all lines carry US area codes.

Beyond messaging

Two products sit next to the messaging API. FaceTime Audio calls start from POST /facetime/start-call, which returns Agora WebRTC credentials that the customer's own client joins; ordinary phone calls route through the customer's Twilio account with a verified caller id. Agent sandboxes are "isolated cloud Linux machines controlled over the Sendblue API": POST /v3/sandboxes creates one, /exec runs a command, /files reads and writes, and a fresh free account receives $100 of sandbox compute after phone verification; a sandbox sleeps after 10 idle minutes and resets its filesystem on wake.

Developer packaging: npm install sendblue and pip install sendblue SDKs; a local Model Context Protocol server, npx -y sendblue-api-mcp@latest, with 18 tools; a Vercel Chat SDK adapter; connectors for GoHighLevel, Close, HubSpot, Salesforce, Follow Up Boss, Monday, Zapier, Make and Slack; and a Chrome extension for click-to-text from any web page.

Compliance as Sendblue states it

Sendblue's docs list "SOC 2 Type 2, HIPAA (dedicated instance required), TCPA compliant", TLS everywhere, HTTPS required for webhooks, and webhook signing secrets. Its own count of scale on the home page on 2026-09-21: "Installed 35,214+ times to generate over $2.1B+ revenue", a figure stated without a window or method. The service is not an Apple program; Sendblue's argument for legitimacy is that messages "go through the same system any normal iMessage user would use", and the same fact means an Apple block on a line ends that line.