Prerequisites
- An AWS SES account
- AWS access keys, or an IAM role Courier can assume
- A verified sender identity in AWS SES
- Your AWS SES region
Setup
Step 1: add the AWS SES integration to Courier
Before choosing an authentication method:- Log in to Courier
- Navigate to the page
- Select the to configure it
Authentication methods
AWS SES integration in Courier supports two authentication methods:- AWS Access Keys
- AWS IAM Role (Cross-Account Trust)
Method 1: AWS access keys
-
Create an AWS SES API Key:
- Log in to AWS SES
- Navigate to “Settings” → “My Security Credentials”
- Go to “Access management” → “Users”
-
On the “Users” page, select “Add user” and follow the steps to create a new IAM user with
AmazonSESFullAccesspermissions
AmazonSESFullAccess, create a custom policy. In the AWS IAM console, open Policies → Create policy and define it in the JSON editor:
- Integrate AWS SES API Key with Courier: After creating the IAM user and obtaining the API keys, add them to the Courier AWS SES integration page.
Method 2: AWS IAM role (Cross-account trust)
- Configure the minimum required IAM policy for sending emails:
- Create an IAM Role with the following trust policy:
-
Users will need to add
/testto the end of theExternalIdvalue that you set in the role policy you create in your AWS instance for working in Courier’s test environment. - After creating the role, copy its ARN and paste it in the “Role ARN” field in the Courier AWS SES integration settings.
-
${YOUR_AWS_ACCOUNT_ID}: Your AWS account ID -
${YOUR_COURIER_WORKSPACE_ID}: Your Courier workspace ID
Finish the setup
After configuring your chosen authentication method, complete the following steps:Step 1: add a verified “from” address in Courier
-
Add a verified email address (e.g., support@acme-corp.com) to the “From Address” field in Courier.
- The “From” email address you set will be used for all emails sent via the AWS SES integration. You can on a per channel basis within your templates.
- Ensure the “From” address is a verified identity in your AWS-SES account.
- For more information on verifying identities, see Verifying an Identity for Amazon SES Sending Authorization .
Step 2: configure AWS SES region
Select your preferred AWS SES region from the dropdown menu in the Courier AWS SES integration.Step 3: create and send a Courier notification using AWS SES
Refer to for instructions on building your notification template and sending a message with the Courier API using cURL. Addressing a recipient and sending are the same on every email provider, so they are documented once: and .Delivery tracking
SENT in your forever.MessageId, which is what your own webhook uses to match the event to the message.
Setup instructions
Setup instructions
Get Your Courier Webhook URL
- Navigate to Channels → Email → AWS SES provider
- Look for “Message Events Webhook URL” section
- Copy the webhook URL
Important: Keep this URL secure - it authenticates webhooks from AWS to Courier.Create AWS SES Configuration Set
- Open the AWS Console and navigate to Amazon SES
- Click Configuration Sets in the left sidebar
- Click Create Configuration Set
- Enter a name (e.g.,
courier-delivery-tracking) - Click Create
Add SNS Event Destination
- Click on your newly created Configuration Set
- Navigate to the Event destinations tab
- Click Add destination
- Select Amazon SNS as the destination type
- Configure the destination:
- Event types: Select
Bounce,Delivery, andReject - SNS Topic:
- Choose Create new SNS topic if you don’t have one
- Or select an existing topic
- Topic Name (if creating new):
courier-ses-delivery-events - Click
Nextand thenAdd destination
Configure SNS Subscription to Courier
- Navigate to Amazon SNS in AWS Console
- Click
Topicsin the left sidebar - Find and click the topic you created/selected in Step 3
- Click
Create subscription - Configure the subscription:
- Protocol:
Select HTTPS - Endpoint: Paste your Courier webhook URL from Step 1
- Enable raw message delivery:
UNCHECKED(very important!) - Click
Create subscription
Assign configuration set to your identity
Assign configuration set to your identity
- In AWS SES Console, navigate to Verified identities
- Click on your verified email address (e.g., noreply@yourdomain.com)
- Go to the Configuration set tab
- Click Edit
- Select your Configuration Set (courier-delivery-tracking)
- Click Save changes
- In AWS SES Console, navigate to Verified identities
- Click on your verified domain (e.g., yourdomain.com)
- Go to the Configuration set tab
- Click Edit
- Select your Configuration Set (courier-delivery-tracking)
- Click Save changes
Resource list of the policy attached to the IAM user (Method 1) or the assumed role (Method 2):"Resource": "*" needs no change. Sends recover on the next retry.Overrides
covers the two levels and which one wins. lists the fields every email provider takes. A provider override changes what Courier sends to SES’s SendRawEmail API.body takes any field that method accepts, and config swaps the AWS credentials and region for one send.
Raw MIME message
override.body.RawMessage.Data sends a MIME 1.0 message of your own in place of the rendered template:
Attachments
override.attachments adds files to the email. Each entry carries a filename, a contentType, and base64-encoded data:
Troubleshooting
Dealing with Amazon SES requests can result in some errors. You can find them below to help you troubleshoot. You can also check the to help debug any provider errors you may encounter. For anything else, you may contact Courier Support.
Amazon SES 554 error
Amazon SES 554 error
- It occurs when you have not verified the sender email (sender identity) on Amazon SES.
- If you’re using the Amazon SES in the sandbox environment and have not verified the recipient’s email address, you may encounter this error.
- You may encounter this error when you’ve provided an invalid recipient email address.
Solution
You can try the following steps mentioned below.-
Open the Amazon SES console and verify that the sender email identity you are using has a verification status of
verified. - If you’re using the sandbox environment, ensure that you have added the recipient email address as a verified identity on the SES console. It is mandatory to add the recipient emails on Amazon SES when running in the Sandbox environment.
- If both the sender and recipient email addresses are verified, ensure that you have provided the correct recipient email address for the “To” parameter.
- If none of the above works for you, verify that the region specified in your AWS SDK is the same region that contains the verified identities. For example, if the verified identities are located in the Virginia region (us-east-1), you should initialize the Amazon SES instance in the same region.
Amazon SES email address is not verified
Amazon SES email address is not verified
Solution
You may try the following to resolve the error.- Verify the region
- Confirm identity verification

Viewing the verified identities on SES
Unverified you will have to verify the identity before sending the email.- Verify email addresses
AWS SES timeout
AWS SES timeout
Solution
To resolve the error, ensure that the client has an active/stable internet connection.Hereafter, update the firewall rules on the client to allow outgoing connections on ports 25, 587, and 465 (depending on the port you use).AWS SES BCC not working
AWS SES BCC not working
Solution
To resolve the error, ensure that the recipient’s email address is not the same as theBCC email address.If the email addresses in the BCC are unique, verify the validity of the email addresses specified in the “BCC” list.Amazon SES authentication credentials invalid
Amazon SES authentication credentials invalid
Solution
- Verify credentials: Ensure that the username and password you enter are correct and the same one SES provided.
- Verify the region: SMTP credentials in Amazon SES differ per region. Therefore, ensure that the credentials used are associated with your region.
- Use SMTP credentials and not console credentials:
- The SMTP endpoint credentials are not your AWS credentials. Use the Amazon SES SMTP credentials to reach the Amazon SES SMTP interface.
- You will have to create an IAM user that can invoke the SES services and generate SMTP credentials for the newly created IAM user. It can be done using the SES console.
- First, navigate to your SES account dashboard. You will see a section titled - “SMTP Settings.” Under this, you should see the output shown below.

Viewing SES Settings in AWS Console

Creating the IAM user

Viewing the SMTP credentials for IAM user
Amazon SES 530 authentication required
Amazon SES 530 authentication required
Solution
You can try the following to see which one fixes the error.- Verify credentials: Ensure that the SMTP username and password you provide are the same credentials you created for the IAM User with permissions to invoke SES.
- Verify the region: Verify that you connect to SES in the region where all your verified identities are located.
- Verify SMTP configurations: Visit the SES console and navigate to your account dashboard. In the account dashboard, you should see the SMTP configurations for SES.

SMTP configurations for SES
- Use the correct port: Ensure that the port used is port - 587. Some users have experienced issues using the TLS Wrapper port and found that using port 587 (TLS port) fixes the error.
AWS SES rate limit
AWS SES rate limit
Solution
To resolve this error, contact AWS and request production access for SES. Your request will be reviewed, and based on your use case, AWS will grant a reasonable email rate for your SES account. Later on, you can increase this rate by contacting AWS.AWS SES email not received
AWS SES email not received
Solution
To resolve the error, verify that all the required handlebar parameters have been added to the templated email parameters when sending the email.Provider details
routing.channels instead is supported, and sends through just this provider.