thanks.io
MARKETING · MARKETING
Handwritten-style postcards, letters, and gift cards sent from that account.
Connect thanks.io with Fabriq Developer
Your user consents at thanks.io. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting thanks.io in practice
thanks.io caps the whole API at 60 requests a minute, which is the real constraint on a direct-mail agent that has to create a mailing list, add recipients and submit an order per customer. Testing mode auto-cancels orders, but a Radius Search bought in testing mode is still charged at $0.05 a record, so the sandbox is not free.
Scopes that draw scrutiny
Bearer tokenThe documented default for "an internal integration for a single thanks.io account" — one token that can submit real, billable mail on that account.OAuth authorization codeThe path for a SaaS or partner integration connecting multiple customer accounts, which means storing a token per customer. Access tokens have a limited lifespan and need refresh logic.
Rate limits
- 60 requests per minute across the API. Over the limit returns 429 Too Many Requests.
- Higher limits are granted by request to support@thanks.io rather than by plan.
Worth knowing
- Testing mode cancels every order submitted through the API, so a pilot proves the payload and never proves delivery.
- Radius Search records are charged at $0.05 each the moment they are bought, including in testing mode, where a purchase is capped at 5 records and a larger one returns 422 with nothing purchased. The dashboard keeps its 2,500-record limit.
- Testing mode has to be switched off in API Settings before real orders fulfil, which is a dashboard step no API call reveals.
- The OAuth authorize endpoint lives on dashboard.thanks.io rather than the API host, so the consent redirect and the API calls point at different domains.
Checked against thanks.io rate limits (2026-09-29), thanks.io API testing mode (2026-09-29), thanks.io choosing an authentication method (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put thanks.io behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.