Configure the Go Client

Pass repost.ClientOptions to the generated NewClient function. Construction validates the options and snapshots their values and environment fallbacks before it accepts sends.

operationTimeout := 30 * time.Second
maxAttempts := 4
maxInFlight := 128

client, err := repostclient.NewClient(repost.ClientOptions{
    APIKey:                os.Getenv("REPOST_SEND_API_KEY"),
    OperationTimeout:      &operationTimeout,
    MaxAttempts:           &maxAttempts,
    MaxInFlightOperations: &maxInFlight,
})

Credential and endpoint precedence

Credential precedence, highest first, is APIKeyProvider resolved once per operation, a fixed APIKey, REPOST_SEND_API_KEY, then REPOST_TOKEN. A provider and a fixed key are mutually exclusive. Without a credential, the first send returns a CONFIGURATION error with NOT_SENT before touching the network. Endpoint precedence is APIURL, REPOST_API_URL, then https://api.repost.sh. The runtime appends /v1/messages when the configured base path does not already end with it. Plain HTTP is accepted only for loopback hosts. Environment values and option values are captured during construction. Later changes do not affect the client. Callback fields such as APIKeyProvider and DNSResolver are borrowed for the client’s lifetime and must be safe for concurrent use.

Client defaults

Option	Default	Notes
`APIKey`	unset	Fixed publish credential. Conflicts with `APIKeyProvider`.
`APIKeyProvider`	unset	Called once per operation before serialization or transport work.
`APIURL`	unset	Resolves `REPOST_API_URL`, then `https://api.repost.sh`.
`ConnectTimeout`	10s	Connection establishment budget.
`AttemptTimeout`	30s	Budget for one HTTP attempt.
`OperationTimeout`	120s	Whole operation, including retry delays.
`MaxAttempts`	4	Includes the first attempt; valid range 1–10.
`RetryBaseDelay` / `RetryMaxDelay`	250ms / 60s	Exponential backoff with full jitter.
`MaxInFlightOperations`	256	Hard admission limit; valid range 1–65,536.
`MaxBufferedBytes`	64 MiB	Aggregate request and response budget; valid range 4 MiB–1 GiB.
`UserAgentSuffix`	unset	Printable ASCII product identifier, up to 256 bytes.
`Transport`	unset	Use the built-in raw transport. A custom transport performs one attempt.
`HTTPTransportOptions`	defaults below	Configures the built-in transport; conflicts with `Transport`.
`Observer` / `Telemetry`	unset	Disabled. See Observability.

Durations must be positive whole milliseconds. Generators, IdempotencyKeyGenerator, RetryEntropy, MonotonicClock, WallClock, and Scheduler are deterministic seams intended mainly for tests. The default user agent is repost-client-go/<version>. UserAgentSuffix adds one space followed by your validated suffix.

Proxy, DNS, TLS, and mTLS

HTTPTransportOptions configures the built-in transport. The runtime copies its value structs and slices at construction. It borrows callback functions.

enableHTTP2 := true
maxConnections := 32

client, err := repostclient.NewClient(repost.ClientOptions{
    HTTPTransportOptions: &repost.HTTPTransportOptions{
        HTTP2:                   &enableHTTP2,
        MaxConnectionsPerOrigin: &maxConnections,
        Proxy: &repost.ProxyOptions{
            URL: "http://proxy.internal:8080",
            CredentialsProvider: func(context.Context) (repost.ProxyCredentials, error) {
                return repost.ProxyCredentials{
                    Username: "service",
                    Password: proxyPassword(),
                }, nil
            },
        },
        TLS: &repost.TLSOptions{
            CACertificatesPEM: []string{rootCAPEM},
            MinVersion:        tls.VersionTLS12,
            MaxVersion:        tls.VersionTLS13,
            ClientCertificate: &repost.ClientCertificate{
                CertificatePEM: clientCertificatePEM,
                KeyPEM:         clientKeyPEM,
                Passphrase:     clientKeyPassphrase,
            },
        },
    },
})

Only explicit http://host:port CONNECT proxies are supported. HTTP_PROXY, HTTPS_PROXY, and NO_PROXY do not alter the client. Proxy credentials are requested only after the configured proxy responds to CONNECT with 407. TLS certificate and hostname verification cannot be disabled. Custom CA certificates replace system trust rather than extending it. TLS 1.2 is the default minimum. You can restrict the maximum to TLS 1.3 and provide an allowlist of TLS 1.2 cipher suites. Client certificates enable mutual TLS. Passphrase-protected keys must use encrypted PKCS #8; deprecated RFC 1423 encrypted PEM is rejected. Set DNSResolver only when your application owns DNS policy. The callback receives the operation context and must return netip.Addr values promptly. The SDK does not cache callback results.

HTTP transport option	Default	Notes
`TLS`	system trust	TLS 1.2 minimum with certificate and hostname verification.
`Proxy`	direct	One explicit CONNECT proxy.
`DNSResolver`	system resolver	Invoked for each new connection when supplied.
`HTTP2`	`true`	HTTP/2 over TLS with HTTP/1.1 fallback.
`MaxConnectionsPerOrigin`	32	Per-origin connection-pool bound; valid range 1–65,536.
`ConnectionLifetime`	5m	Maximum age of a pooled connection.
`ConnectionIdleTimeout`	2m	Maximum time an idle connection remains pooled.

Redirects are disabled. A custom Transport replaces socket behavior only; the runtime still owns validation, serialization, retries, deadlines, idempotency, admission, and response parsing.

Continue

Reliability

See how deadlines, retries, cancellation, and capacity settle.

Observability

Attach diagnostics, observers, metrics, and traces.

Frameworks

Own one client for the application lifecycle.

Send

Schema

Publishing

Delivery

Customer experience

TypeScript

Go

C#

Python

Java

Kotlin

Configure the Go Client

Credential and endpoint precedence

Client defaults

Proxy, DNS, TLS, and mTLS

Continue

Reliability

Observability

Frameworks

​Credential and endpoint precedence

​Client defaults

​Proxy, DNS, TLS, and mTLS

​Continue

Reliability

Observability

Frameworks

Credential and endpoint precedence

Client defaults

Proxy, DNS, TLS, and mTLS

Continue