Drafting and sending have different permissions
Buttondown’s 25 October changelog says it fixed email creation bypassing a key’s sending restriction. Creation that would send now returns HTTP 403 without sending access. The change includes scheduled messages, a supplied publication date and omitted status on API versions before 1 April 2026. Draft creation is unchanged, according to the provider.
Check the integration’s purpose
The authentication reference separates email management from sending access. It also says the primary account key has full access and cannot be restricted. A named key for an integration makes its intended permission boundary easier to inspect.
- Record whether the integration needs to draft, schedule or send.
- Check its API version and the status it supplies.
- Inspect its key permissions without exposing the key itself.
- Review errors and retries before authorizing another attempt. Do not assume that retrying a failed request is harmless.
Fewertools has not executed these API calls. Confirm behaviour in an authorized test workflow before changing production. See the newsletter import checklist and Buttondown’s separately dated plan notes.
Sources and scope
- Buttondown changelog
- API authentication and permissions
- Create-email reference
- Fewertools dated source receipt
Provider claims are attributed. Worksheets below or above are proposed checks, not executed workflows. No paid provider, installation, account action or email send was used for this report.