Email & Domain Tier 3 Ready POST /v1/consent-tokens/issue

RFC 8058 One-Click Unsubscribe & Consent Token API — Stateless HMAC Tokens

Issue and verify stateless HMAC unsubscribe tokens and RFC 8058 List-Unsubscribe headers. Issue and verify stateless, tamper-proof HMAC-SHA256 unsubscribe tokens and RFC 8058 List-Unsubscribe headers without a token database.

Additional endpoints in this module: POST /v1/consent-tokens/verify

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/consent-tokens/issue`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkNUSyIsImtpZCI6InYxIn0.eyJzdWIiOiJ1c2VyXzg4MjEiLCJzY29wZSI6Im1hcmtldGluZ193ZWVrbHkiLCJwdXJwb3NlIjpudWxsLCJpYXQiOjE3OTQ2Nzc5NzcsImV4cCI6MTc5NzI2OTk3NywianRpIjoiZTdiZjdlZWUyM2YwNTE5ZjZmMTc5YzdmIn0.RtcMe0_1rKoCjq2g-CU-YO2c3hLtUniFFU2M6B7U8PM",
    "kid": "v1",
    "issued_at": "2026-11-14T17:39:37.000Z",
    "expires_at": "2026-12-14T17:39:37.000Z",
    "payload": {
      "sub": "user_8821",
      "scope": "marketing_weekly",
      "purpose": null,
      "iat": 1794677977,
      "exp": 1797269977,
      "jti": "e7bf7eee23f0519f6f179c7f"
    },
    "rfc8058_headers": null
  },
  "meta": {
    "request_id": "req_ct_01",
    "ms": 1
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/consent-tokens/issue" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"subject":"user_8821","scope":"marketing_weekly","secret":"unsubscribe-hmac-secret-key-2026","ttl_seconds":2592000,"unsubscribe_url_base":"https://example.com/unsub"}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/consent-tokens/issue", {
  "subject": "user_8821",
  "scope": "marketing_weekly",
  "secret": "unsubscribe-hmac-secret-key-2026",
  "ttl_seconds": 2592000,
  "unsubscribe_url_base": "https://example.com/unsub"
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/consent-tokens/issue",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "subject": "user_8821",
  "scope": "marketing_weekly",
  "secret": "unsubscribe-hmac-secret-key-2026",
  "ttl_seconds": 2592000,
  "unsubscribe_url_base": "https://example.com/unsub"
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/consent-tokens/issue", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "subject": "user_8821",
  "scope": "marketing_weekly",
  "secret": "unsubscribe-hmac-secret-key-2026",
  "ttl_seconds": 2592000,
  "unsubscribe_url_base": "https://example.com/unsub"
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_consent_tokens",
    "arguments": {
      "subject": "user_8821",
      "scope": "marketing_weekly",
      "secret": "unsubscribe-hmac-secret-key-2026",
      "ttl_seconds": 2592000,
      "unsubscribe_url_base": "https://example.com/unsub"
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/consent-tokens/issue`)

Parameter	Type & Constraints	Description
`subject`required	`string` minLen: 1, maxLen: 256	Opaque subscriber or user identifier (avoid raw email if not needed).
`scope`required	`string` minLen: 1, maxLen: 128	Consent or unsubscribe scope.
`purpose`optional	`string` minLen: 1, maxLen: 128	Field 'purpose'
`ttl_seconds`optional	`integer` min: 60, max: 31536000	Token lifetime in seconds (default 30 days).
`kid`optional	`string` minLen: 1, maxLen: 64	Key identifier for key rotation.
`secret`required	`string` minLen: 16, maxLen: 512	Tenant HMAC-SHA256 signing secret (min 16 chars, never logged or stored).
`unsubscribe_base_url`optional	`string` maxLen: 512	Optional HTTPS URL to generate RFC 8058 List-Unsubscribe headers.

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`token`	`string`	Field 'token'
`kid`	`string`	Field 'kid'
`issued_at`	`string`	Field 'issued_at'
`expires_at`	`string`	Field 'expires_at'
`payload`	`object`	Field 'payload'
`rfc8058_headers`	`object \| null`	Field 'rfc8058_headers'

3. What Stateless Consent & One-Click Unsubscribe Tokens API Detects & Validates

Signs compact URL-safe tokens binding user ID, mailing list/channel, and expiration timestamp
Generates ready-to-send RFC 8058 List-Unsubscribe and List-Unsubscribe-Post email headers required by Gmail & Yahoo
Verifies token integrity and expiration in constant time via WebCrypto HMAC-SHA256

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Stateless tokens remain valid until exp unless rotated or checked against a revocation list in your application.
Tested v1.0.4 (14 November 2026).

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

Why do I need RFC 8058 List-Unsubscribe headers?

Gmail and Yahoo mandate RFC 8058 one-click unsubscribe headers on all marketing and bulk emails.

Do I need a database to store issued unsubscribe tokens?

No. The token is self-contained and cryptographically signed with your HMAC secret.

How do I verify a token when a user clicks unsubscribe?

Send the token and your secret to POST /v1/consent-tokens/verify to recover the verified subject and channel.

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

Signing secrets and subject identifiers are never logged or stored.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.