How to send email from PHP/XAMPP through Pegasus Mail without SMTP passwords

A local PHP or XAMPP application can send plain-text email through a running Pegasus Mail client without storing an SMTP password in PHP code. Pegasus Bridge provides an authenticated local API and an included PHP client. When the XAMPP component is selected during installation, Setup gives Apache controlled read access to the bridge token and keeps that token outside the web root, WordPress and the database.

When this approach is useful

• A PHP application runs locally under XAMPP on the same Windows computer as Pegasus Mail.
• You want the application to use the existing Pegasus Mail configuration.
• You do not want to duplicate SMTP credentials in PHP files, WordPress options or a database.
• Plain-text email without attachments is sufficient.

Requirements

• 64-bit Windows 10 or Windows 11
• Pegasus Mail for Windows, configured and running
• Pegasus Bridge 1.0.3 or later
• PHP with the cURL extension
• XAMPP integration selected in Pegasus Bridge Setup or Modify
• Pegasus Mail and Pegasus Bridge running as the same signed-in Windows user

1. Enable the XAMPP integration

Select the XAMPP component when installing Pegasus Bridge. If the product is already installed, run Setup again and choose Modify.

Setup creates a managed Apache include containing the PEGASUS_BRIDGE_TOKEN_FILE environment variable. It points to the protected token file outside the web root. The Apache service identity receives only the access needed to traverse the runtime directory and read that token file. Setup validates the Apache configuration and rolls the change back if validation fails.

2. Check the integration from PHP

<?php
$tokenFile = getenv('PEGASUS_BRIDGE_TOKEN_FILE');

if (!$tokenFile) {
    throw new RuntimeException(
        'PEGASUS_BRIDGE_TOKEN_FILE is not available to PHP.'
    );
}

if (!is_readable($tokenFile)) {
    throw new RuntimeException(
        'The configured Pegasus Bridge token file is not readable.'
    );
}

echo 'Pegasus Bridge authentication path is available.';

This diagnostic deliberately prints neither the path nor the token. Remove it after confirming the integration.

3. Send email from PHP through Pegasus Mail

<?php
declare(strict_types=1);

require 'C:\PMAIL\Pegasus Bridge\clients\send.php';

$result = pegasus_bridge_send(
    'sender@example.com',
    ['recipient@example.com'],
    'PHP/XAMPP test',
    "First line\n\nThird line / Кирилица",
    'replies@example.com'
);

if (($result['status'] ?? '') !== 'accepted_by_pegasus') {
    throw new RuntimeException('Message was not accepted by Pegasus Mail.');
}

echo 'Message accepted by Pegasus Mail.';

Change the client path if Pegasus Bridge is installed elsewhere. The second argument is an array, so it can contain one or more recipient addresses. The optional fifth argument is Reply-To; when omitted or empty, it defaults to the value supplied as from.

Use double-quoted PHP strings or another method that creates real line-break characters when the body contains multiple lines. In a single-quoted PHP string, \n remains literal text.

How authentication works

• Pegasus Bridge Setup generates a random bearer token.
• The token is stored in a protected file outside the application and web root.
• The included PHP client reads the path from PEGASUS_BRIDGE_TOKEN_FILE.
• The client sends the token only to the local endpoint at 127.0.0.1:18765.
• The token is not an SMTP password and does not select a Pegasus Mail identity.

What accepted_by_pegasus means

A successful call returns HTTP 202 with accepted_by_pegasus. Pegasus Mail accepted the validated send operation. This is not proof of final delivery; delivery still depends on Pegasus Mail, your mail provider and the recipient's server.

Security boundaries

• Do not expose the bridge endpoint to the LAN, router or internet.
• Do not create a PHP page that displays the token, token path, raw exception data or configuration.
• Do not accept arbitrary sender, recipient or message fields from unauthenticated public requests.
• Apply the normal authentication, authorization, validation, rate limiting and anti-CSRF controls of your local application.
• Normal Pegasus Bridge logs exclude recipients, subject, message content and access token.

Current limitations

• Plain-text messages only; no HTML or attachments
• No CC, BCC or custom headers
• The PHP application cannot select a Pegasus Mail identity
• A signed-in Windows user and a running Pegasus Mail client are required
• The integration is intended for controlled local use on the same Windows computer

Troubleshooting

PEGASUS_BRIDGE_TOKEN_FILE is missing

Run Pegasus Bridge Setup, choose Modify and enable the XAMPP component. Restart Apache after a successful configuration change.

PHP reports a cURL error

Confirm that the PHP cURL extension is enabled and that Pegasus Bridge is running. The included client uses a short connection timeout and calls only the local endpoint.

Pegasus Bridge reports pegasus_unavailable

Start Pegasus Mail and verify that it runs in the same signed-in Windows session as Pegasus Bridge. A Windows service cannot provide the required interactive Pegasus Mail session.

The From address is unexpected

Select the required identity in Pegasus Mail before sending. The active Pegasus Mail identity controls the actual MIME From address; the PHP argument cannot switch identities remotely.