Browser-safe sending

    Send from the browser, safely.

    Publishable keys (mnxpub_) are bearer tokens designed to live in client-side JavaScript. Five server-side gates make them safe to embed.

    Get startedRead the docs

    01

    Five-axis gate

    Origin lock, recipient allow-list, locked From, sliding-window rate caps (per-IP / per-recipient / per-key), optional Turnstile or hCaptcha.

    02

    Copy-paste fetch snippet

    Vanilla JS, zero dependencies. The dashboard's create-key modal renders a per-key snippet with the freshly minted token embedded.

    03

    Reveal URL flow (MCP)

    The MCP create-tool returns a single-use 5-minute reveal URL rather than the bare token, so secrets never sit in agent chat history.

    04

    Attachments locked off

    Publishable keys reject attachments at the server. CSP can't defend against the exfiltration vector; we just don't allow it.

    One HTTP call to get started

    Put a form on your site tonight. Wire your provider when you're ready.