Amazon SES is the third alternative email service in Settings → VisionScaper Messaging. VisionScaper signs its own requests to the SES API, so it needs an AWS access key ID, a secret access key and the AWS region. It does not use SMTP.

• An AWS account.
• A verified domain or address in SES, in the same region (see the next article).
• Someone comfortable with AWS screens. AWS changes them often.

1. Pick the region where you will send, for example us-east-1. Keep it the same everywhere.
2. In the IAM console create a new user just for VisionScaper. AWS recommends a separate user for each use.
3. Give the user a policy that allows sending only. AWS’s SES page shows this policy for API version 2:
   – Actions: ses:SendEmail and ses:SendRawEmail
   – A condition that ses:ApiVersion equals 2
   – You can also limit the resource to your identity or a single From address.
4. Open the user’s Security credentials tab. In the Access keys section choose Create access key.
5. On the “Access key best practices & alternatives” page choose your use case. AWS suggests alternatives to long-term keys. If you still need one, choose Other, then Next.
6. Optionally add a description, then choose Create access key.
7. On the Retrieve access keys page, choose Show or Download .csv file. AWS says this is your only chance to save the secret access key.
8. In WordPress open Settings → VisionScaper Messaging, section Email.
9. In Email service, choose Amazon SES.
10. Paste the access key ID into Amazon access key and the secret into Amazon secret key. Both are hidden fields.
11. Type the region in Amazon region (like us-east-1). If left blank, the code uses us-east-1.
12. Fill Amazon webhook secret only if you set up event feedback (see the SMTP article for the gap).
13. Click Save.
14. In Settings → VisionScaper Marketing set Send from address to a verified identity.

• Each IAM user can have at most two access keys.
• Rotate the key if anyone who knew it leaves. Deactivate, check nothing breaks, then delete.
• The region you enter must be the region where your identity is verified.

• Access denied. The policy is missing ses:SendEmail or the condition blocks it.
• Email address not verified. The From address or domain is not verified in this region.
• “MessageRejected” when sending to a stranger. The account is still in the SES sandbox (see the sandbox article).

• AWS, IAM access keys: https://docs.aws.amazon.com/IAM/latest/UserGuide/access-key-self-managed.html (read 2026-10-15)
• AWS, SES access control policy for API v2: https://docs.aws.amazon.com/ses/latest/dg/control-user-access.html
• Plugin: includes/messaging-providers.php (SES API v2, signed requests, default region).

• Verify your domain in Amazon SES
• Move Amazon SES out of the sandbox
• Amazon SES SMTP credentials versus API keys
• Get your Postmark Server API token