ProtonMail API

Before writing any code, confirm you're using the right Proton access path. There are two options: **Proton Mail Bridge** runs as a local desktop application and exposes SMTP on `127.0.0.1:1025` (or similar). It works for local tools — Thunderbird, Apple Mail, or a local Node.js script — but cannot be used in a Firebase Cloud Function because a cloud server has no access to your local machine. Do not attempt to use Bridge as a cloud sender. **SMTP submission tokens** (Proton Business) are the hosted solution. They allow an external SMTP client — in your case, a Firebase Cloud Function — to authenticate with Proton's public SMTP server (`smtp.protonmail.com`, port 587, STARTTLS) using a token tied to a specific email address on your domain. To generate an SMTP submission token: log in to your Proton Business account at account.proton.me, go to **Settings** → **Email** (or **All Settings** → **Mail** → **SMTP submission**). Click **Generate Token** for the address you want to use as the sender (e.g., `noreply@yourdomain.com`). Copy the token immediately — it is shown only once. Store it in a password manager. Also confirm that your sender domain is verified in Proton Mail (SPF, DKIM, DMARC records should all be green in **Settings** → **Domain names**). Sending from an unverified domain results in delivery failures or spam classification.

In the Firebase Console, navigate to your project and confirm it is on the Blaze (pay-as-you-go) plan — the free Spark plan blocks all outbound network connections, including SMTP. Open Functions and prepare your local `functions/` directory. Install nodemailer as a dependency in your `functions/package.json` by adding `"nodemailer": "^6.9.0"` to the dependencies object (Firebase CLI will install it during deploy). Create the Cloud Function shown below. Store your Proton SMTP credentials as Firebase environment config (run these in your terminal before deploying): ``` firebase functions:config:set proton.user="noreply@yourdomain.com" proton.token="YOUR_SMTP_SUBMISSION_TOKEN" ``` The function creates a nodemailer transporter connecting to `smtp.protonmail.com` on port 587 with STARTTLS (`requireTLS: true` or `starttls: {required: true}`). The username is your full Proton email address. The password is the SMTP submission token (NOT your Proton account password). After deploying with `firebase deploy --only functions`, the HTTPS trigger URL will appear in the Firebase Console. This URL is what FlutterFlow will POST to. Test the function first using a browser-based REST client (Hoppscotch, Postman) by sending a POST with a JSON body containing `to`, `subject`, and `body` fields before wiring it into FlutterFlow.

1// functions/index.js
2const functions = require('firebase-functions');
3const admin = require('firebase-admin');
4const nodemailer = require('nodemailer');
5
6admin.initializeApp();
7const db = admin.firestore();
8
9const PROTON_USER = functions.config().proton.user;
10const PROTON_TOKEN = functions.config().proton.token;
11
12const transporter = nodemailer.createTransport({
13  host: 'smtp.protonmail.com',
14  port: 587,
15  secure: false, // STARTTLS on port 587
16  requireTLS: true,
17  auth: {
18    user: PROTON_USER,
19    pass: PROTON_TOKEN   // SMTP submission token, NOT account password
20  }
21});
22
23exports.sendViaProton = functions.https.onRequest(async (req, res) => {
24  if (req.method !== 'POST') return res.status(405).send('Method Not Allowed');
25
26  const { to, subject, body, htmlBody } = req.body;
27  if (!to || !subject || !body) {
28    return res.status(400).json({ error: 'to, subject, and body are required' });
29  }
30
31  try {
32    const info = await transporter.sendMail({
33      from: `"Your App" <${PROTON_USER}>`,
34      to,
35      subject,
36      text: body,
37      html: htmlBody || undefined
38    });
39    // Log to Firestore for records
40    await db.collection('proton_sent').add({
41      to,
42      subject,
43      messageId: info.messageId,
44      sentAt: admin.firestore.FieldValue.serverTimestamp()
45    });
46    return res.status(200).json({ messageId: info.messageId, accepted: info.accepted });
47  } catch (err) {
48    return res.status(500).json({ error: err.message });
49  }
50});

With the Cloud Function deployed and tested, configure FlutterFlow to call it. In the FlutterFlow editor, click **API Calls** in the left navigation panel. Click **+ Add** → **Create API Group**. Name the group `ProtonProxy` and set the Base URL to the root of your Firebase Functions URL (e.g., `https://us-central1-yourproject.cloudfunctions.net`). Inside the group, click **+ Add API Call** and name it `SendEmail`. Set the method to `POST` and the endpoint to `/sendViaProton` (matching your function export name exactly). In the **Variables** tab, add four variables: - `to` (String) — the recipient's email address - `subject` (String) — the email subject line - `body` (String) — the plain-text email body - `htmlBody` (String, optional) — HTML version of the body In the **Body** section, choose **JSON** and enter: ```json {"to":"{{to}}","subject":"{{subject}}","body":"{{body}}","htmlBody":"{{htmlBody}}"} ``` No `Authorization` header is needed here — authentication is fully handled inside the Cloud Function. Switch to **Response & Test**, paste a sample success response `{"messageId":"<abc123@protonmail.com>","accepted":["recipient@example.com"]}`, and click **Generate JSON Paths** to create `$.messageId` and `$.accepted` paths. Click **Test API Call** with real values (use your own email as `to` for testing) and confirm you receive the email. If you see a 500 error, check the Firebase Function logs in the Console for SMTP error details.

1// FlutterFlow API Call configuration
2{
3  "group_name": "ProtonProxy",
4  "base_url": "https://us-central1-yourproject.cloudfunctions.net",
5  "calls": [
6    {
7      "name": "SendEmail",
8      "method": "POST",
9      "endpoint": "/sendViaProton",
10      "headers": {},
11      "body_type": "JSON",
12      "body": {
13        "to": "{{to}}",
14        "subject": "{{subject}}",
15        "body": "{{body}}",
16        "htmlBody": "{{htmlBody}}"
17      },
18      "variables": [
19        { "name": "to", "type": "String" },
20        { "name": "subject", "type": "String" },
21        { "name": "body", "type": "String" },
22        { "name": "htmlBody", "type": "String", "default": "" }
23      ]
24    }
25  ]
26}

Add a new screen in FlutterFlow for your email composition form, or integrate the send action into an existing screen (a contact form, a support request screen, or an order confirmation). Place the following widgets: - A `TextField` for the recipient's email address (or pre-fill it from a Firestore user document) - A `TextField` for the subject line - A multi-line `TextField` for the message body - A `Button` labeled 'Send Email' Select the Button, open its **Actions** panel, and click **+ Add Action**. Choose **Backend/API Call** → **ProtonProxy → SendEmail**. In the variable bindings: - `to`: bind to the recipient TextField's current value (or a hardcoded address for a contact-to-owner scenario) - `subject`: bind to the subject TextField's current value - `body`: bind to the message body TextField's current value - `htmlBody`: leave empty (or bind to a pre-composed HTML string stored in App State) Add a second chained action: **Show Snack Bar** with conditional text — if the response contains `$.messageId` (non-empty string), show 'Email sent successfully from your Proton Mail address.' Otherwise, show 'Failed to send — please try again or check your connection.' For contact-form use cases where the app owner is always the recipient, hard-code the `to` field (e.g., `support@yourdomain.com`) in the API Call binding rather than showing it as a user-editable field. This prevents users from redirecting emails to unintended addresses.

If you're using FlutterFlow's web preview, Run mode, or plan to publish as a web app, the Firebase Cloud Function must return CORS headers. Browser-based HTTP requests (from FlutterFlow's web renderer and from the published web app) include an `Origin` header, and the browser blocks responses that don't include `Access-Control-Allow-Origin`. Native iOS and Android builds don't enforce CORS, so this step is only critical for web targets. Install the `cors` npm package in your `functions/package.json` (`"cors": "^2.8.5"`) and update your Cloud Function to use it, as shown in the code snippet below. The `cors({ origin: true })` middleware reflects the request's Origin header back in the response, which satisfies the browser's CORS check without hard-coding specific domains. After redeploying with CORS support, test the full flow in FlutterFlow's Run mode (web preview). Open the email form screen, fill in all fields, and tap Send. If you see a successful Snack Bar and an email in the Proton inbox, the integration is complete. If you're building iOS/Android only and have confirmed the function works in the FlutterFlow API test tab, you can skip the CORS step. For production, consider adding input validation to your Cloud Function: check that `to` is a valid email format, that `subject` is not empty, and that `body` does not exceed a reasonable length (e.g., 10,000 characters) to prevent abuse. Adding rate-limiting (checking Firestore for recent sends from the same user) is also recommended for contact forms to prevent spam.

1// Updated index.js with CORS support
2const functions = require('firebase-functions');
3const admin = require('firebase-admin');
4const nodemailer = require('nodemailer');
5const cors = require('cors')({ origin: true });
6
7admin.initializeApp();
8const db = admin.firestore();
9
10const PROTON_USER = functions.config().proton.user;
11const PROTON_TOKEN = functions.config().proton.token;
12
13const transporter = nodemailer.createTransport({
14  host: 'smtp.protonmail.com',
15  port: 587,
16  secure: false,
17  requireTLS: true,
18  auth: { user: PROTON_USER, pass: PROTON_TOKEN }
19});
20
21exports.sendViaProton = functions.https.onRequest((req, res) => {
22  cors(req, res, async () => {
23    if (req.method !== 'POST') return res.status(405).send('Method Not Allowed');
24    const { to, subject, body, htmlBody } = req.body;
25    if (!to || !subject || !body) {
26      return res.status(400).json({ error: 'to, subject, and body are required' });
27    }
28    try {
29      const info = await transporter.sendMail({
30        from: `"Your App" <${PROTON_USER}>`,
31        to, subject,
32        text: body,
33        html: htmlBody || undefined
34      });
35      await db.collection('proton_sent').add({
36        to, subject,
37        messageId: info.messageId,
38        sentAt: admin.firestore.FieldValue.serverTimestamp()
39      });
40      return res.status(200).json({ messageId: info.messageId, accepted: info.accepted });
41    } catch (err) {
42      return res.status(500).json({ error: err.message });
43    }
44  });
45});