The visible interface is four fields and a button. The operational path includes validation, abuse control, provider delivery, timeout behaviour, duplicate submission handling, and user recovery.
The server boundary
Provider credentials remain server-only. The endpoint enforces strict field limits, applies abuse controls and rate limits, and uses an idempotency key so repeated browser submissions do not create repeated messages.
The delivery call has a fixed timeout. The request cannot remain open indefinitely because a provider is slow.
Failure still needs a useful outcome
The client distinguishes validation errors, delivery failures, and network errors. A direct email path remains visible when the provider cannot complete the request.
The system is small, but the standard is the same as any integration: define the boundary, bound the wait, prevent duplicates, and make recovery clear.