> ## Documentation Index > Fetch the complete documentation index at: https://repost.sh/docs/llms.txt > Use this file to discover all available pages before exploring further. # Configure the Go Client > Configure credentials, deadlines, retries, capacity, proxy, DNS, TLS, mTLS, HTTP/2, and connection pooling. Pass `repost.ClientOptions` to the generated `NewClient` function. Construction validates the options and snapshots their values and environment fallbacks before it accepts sends. ```go theme={"languages":{"custom":["/languages/repost.json"]}} operationTimeout := 30 * time.Second maxAttempts := 4 maxInFlight := 128 client, err := repostclient.NewClient(repost.ClientOptions{ APIKey: os.Getenv("REPOST_SEND_API_KEY"), OperationTimeout: &operationTimeout, MaxAttempts: &maxAttempts, MaxInFlightOperations: &maxInFlight, }) ``` ## Credential and endpoint precedence Credential precedence, highest first, is `APIKeyProvider` resolved once per operation, a fixed `APIKey`, `REPOST_SEND_API_KEY`, then `REPOST_TOKEN`. A provider and a fixed key are mutually exclusive. Without a credential, the first send returns a `CONFIGURATION` error with `NOT_SENT` before touching the network. Endpoint precedence is `APIURL`, `REPOST_API_URL`, then `https://api.repost.sh`. The runtime appends `/v1/messages` when the configured base path does not already end with it. Plain HTTP is accepted only for loopback hosts. Environment values and option values are captured during construction. Later changes do not affect the client. Callback fields such as `APIKeyProvider` and `DNSResolver` are borrowed for the client's lifetime and must be safe for concurrent use. ## Client defaults | Option | Default | Notes | | ---------------------------------- | -------------- | ------------------------------------------------------------------------ | | `APIKey` | unset | Fixed publish credential. Conflicts with `APIKeyProvider`. | | `APIKeyProvider` | unset | Called once per operation before serialization or transport work. | | `APIURL` | unset | Resolves `REPOST_API_URL`, then `https://api.repost.sh`. | | `ConnectTimeout` | 10s | Connection establishment budget. | | `AttemptTimeout` | 30s | Budget for one HTTP attempt. | | `OperationTimeout` | 120s | Whole operation, including retry delays. | | `MaxAttempts` | 4 | Includes the first attempt; valid range 1–10. | | `RetryBaseDelay` / `RetryMaxDelay` | 250ms / 60s | Exponential backoff with full jitter. | | `MaxInFlightOperations` | 256 | Hard admission limit; valid range 1–65,536. | | `MaxBufferedBytes` | 64 MiB | Aggregate request and response budget; valid range 4 MiB–1 GiB. | | `UserAgentSuffix` | unset | Printable ASCII product identifier, up to 256 bytes. | | `Transport` | unset | Use the built-in raw transport. A custom transport performs one attempt. | | `HTTPTransportOptions` | defaults below | Configures the built-in transport; conflicts with `Transport`. | | `Observer` / `Telemetry` | unset | Disabled. See [Observability](/docs/send/go/observability). | Durations must be positive whole milliseconds. `Generators`, `IdempotencyKeyGenerator`, `RetryEntropy`, `MonotonicClock`, `WallClock`, and `Scheduler` are deterministic seams intended mainly for tests. The default user agent is `repost-client-go/`. `UserAgentSuffix` adds one space followed by your validated suffix. ## Proxy, DNS, TLS, and mTLS `HTTPTransportOptions` configures the built-in transport. The runtime copies its value structs and slices at construction. It borrows callback functions. ```go theme={"languages":{"custom":["/languages/repost.json"]}} enableHTTP2 := true maxConnections := 32 client, err := repostclient.NewClient(repost.ClientOptions{ HTTPTransportOptions: &repost.HTTPTransportOptions{ HTTP2: &enableHTTP2, MaxConnectionsPerOrigin: &maxConnections, Proxy: &repost.ProxyOptions{ URL: "http://proxy.internal:8080", CredentialsProvider: func(context.Context) (repost.ProxyCredentials, error) { return repost.ProxyCredentials{ Username: "service", Password: proxyPassword(), }, nil }, }, TLS: &repost.TLSOptions{ CACertificatesPEM: []string{rootCAPEM}, MinVersion: tls.VersionTLS12, MaxVersion: tls.VersionTLS13, ClientCertificate: &repost.ClientCertificate{ CertificatePEM: clientCertificatePEM, KeyPEM: clientKeyPEM, Passphrase: clientKeyPassphrase, }, }, }, }) ``` Only explicit `http://host:port` CONNECT proxies are supported. `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` do not alter the client. Proxy credentials are requested only after the configured proxy responds to CONNECT with `407`. TLS certificate and hostname verification cannot be disabled. Custom CA certificates replace system trust rather than extending it. TLS 1.2 is the default minimum. You can restrict the maximum to TLS 1.3 and provide an allowlist of TLS 1.2 cipher suites. Client certificates enable mutual TLS. Passphrase-protected keys must use encrypted PKCS #8; deprecated RFC 1423 encrypted PEM is rejected. Set `DNSResolver` only when your application owns DNS policy. The callback receives the operation context and must return `netip.Addr` values promptly. The SDK does not cache callback results. | HTTP transport option | Default | Notes | | ------------------------- | --------------- | ----------------------------------------------------------- | | `TLS` | system trust | TLS 1.2 minimum with certificate and hostname verification. | | `Proxy` | direct | One explicit CONNECT proxy. | | `DNSResolver` | system resolver | Invoked for each new connection when supplied. | | `HTTP2` | `true` | HTTP/2 over TLS with HTTP/1.1 fallback. | | `MaxConnectionsPerOrigin` | 32 | Per-origin connection-pool bound; valid range 1–65,536. | | `ConnectionLifetime` | 5m | Maximum age of a pooled connection. | | `ConnectionIdleTimeout` | 2m | Maximum time an idle connection remains pooled. | Redirects are disabled. A custom `Transport` replaces socket behavior only; the runtime still owns validation, serialization, retries, deadlines, idempotency, admission, and response parsing. ## Continue See how deadlines, retries, cancellation, and capacity settle. Attach diagnostics, observers, metrics, and traces. Own one client for the application lifecycle.