Skip to main content

Documentation Index

Fetch the complete documentation index at: https://documentation.onesignal.com/llms.txt

Use this file to discover all available pages before exploring further.

Add BCC (blind carbon copy) recipients to a OneSignal email so the message is also delivered to one or more hidden addresses. BCC recipients receive the same content as the primary recipient and are not visible to anyone else on the send. Common use cases:
  • Archive customer-facing email to a shared inbox or compliance system.
  • Forward sends to third-party services like Trustpilot Automatic Feedback Service (AFS).
  • Keep internal stakeholders copied on transactional or high-value sends.
Do not BCC password resets, magic links, two-factor codes, or any email containing sensitive data. The BCC recipient sees the full personalized message body. Treat BCC as a content disclosure and pick recipients deliberately.

​
Prerequisites

  • Complete Email setup and verify your sending domain.
  • Confirm your billing plan accommodates additional volume. For every email sent, an additional email is sent to each BCC address. See Billing and analytics.

​
How BCC works in OneSignal

  • BCC recipients are set per message at send time. There is no account-level default BCC.
  • BCC sends count toward your billable email volume.
  • Each BCC address adds one send per recipient to your email volume: OneSignal sends one email to your recipient and one email to each BCC address.
  • BCC sends are excluded from engagement metrics (open rate, click rate, conversions) and included in your total send count so billing remains accurate.
  • BCC addresses are validated for syntax only (the same check OneSignal applies to the From address). Deliverability, suppression status, and domain ownership are not verified.
Because BCC addresses are not validated for deliverability, a typo or bounced address fails silently with no retry and no notification. Send a test message to each BCC address before relying on it for compliance workflows.

​
Send a BCC email from the dashboard

  1. In your OneSignal dashboard, go to Messages > New Message > Email.
  2. Compose your email. Set the audience, subject, and content as usual.
  3. In the Sender section, locate the BCC field.
  4. Enter one or more email addresses, separated by commas: 
    archive@yourdomain.com, compliance@yourdomain.com
  5. Click Review and Send to deliver immediately, or Save to keep the message as a draft.
Expected outcome: Each BCC address receives a copy of the email at the same time as the primary recipient. The primary recipient cannot see the BCC list, and BCC recipients cannot see one another.
After sending, open Delivery > Sent Messages and select the message to confirm the BCC recipients appear on the message detail page.

​
Use BCC with a template

BCC addresses are configured directly on an email template and apply to every send that uses it.
  1. Go to Messages > Email > Templates and open or create a template.
  2. In the Sender section, locate the BCC field.
  3. Enter up to 5 addresses, separated by commas.
  4. Save the template.

​
Use BCC in a Journey

When you select a template in a Journey’s Send Email step, the BCC addresses from that template appear in the Sender Settings section of the step. They are read-only from here. To update them, select Edit next to the template name to modify the template directly.
Changes to a template’s BCC addresses apply to all future sends using that template, including active Journeys.

​
Send a BCC email via the API

Pass a bcc array on the Create message endpoint. Each entry must be a syntactically valid email address. 
curl -X POST 'https://api.onesignal.com/notifications' \
  -H 'Authorization: Key YOUR_REST_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "app_id": "YOUR_APP_ID",
    "include_aliases": { "external_id": ["user-123"] },
    "target_channel": "email",
    "email_subject": "Your receipt",
    "email_body": "<p>Thanks for your purchase.</p>",
    "bcc": ["archive@yourdomain.com", "compliance@yourdomain.com"]
  }'

​
Request fields

​
bcc
string[]
An array of email addresses to receive a hidden copy of the message. Each address must pass basic syntax validation (the same check OneSignal applies to the From address). Deliverability, suppression status, and domain ownership are not verified. Invalid addresses fail silently and are not retried.

​
Errors

If any entry in bcc fails syntax validation, the API returns 400 Bad Request with an Invalid BCC address error and the message is not sent. Fix or remove the offending entry and retry.

​
Billing and analytics

MetricBehavior
Total email sendsIncludes BCC recipients. For every email sent, an additional email is sent to each BCC address.
Open rate, click rate, conversionsExcludes BCC recipients.
Delivery, bounce, and complaint eventsExcludes BCC recipients.
Suppression listNot enforced for BCC addresses. A suppressed address still receives the BCC copy.
Plan for the volume increase before enabling BCC at scale. Each BCC address adds one additional email per recipient to your billable volume.
For high-volume archive use cases, such as mirroring every send to a compliance store, evaluate whether Event Streams meets your requirements. Event Streams capture send and engagement data without adding to your email volume.

​
Best practices

  • Send a test before going live. Add the BCC address to a one-off message and confirm receipt in the destination inbox before adding it to production sends.
  • Use a dedicated inbox with sufficient capacity. Route BCC traffic to a purpose-built inbox like archive@mail.yourdomain.com, not a shared or personal account. Free-tier and shared mailboxes fill up quickly at scale: a 1 GB inbox can reach capacity after as few as 60,000 emails depending on message size. When the BCC inbox is full, all remaining BCC deliveries fail silently with no retry.
  • Keep the list short. Each BCC recipient adds billable volume. A single archive address is usually sufficient for compliance.
  • Exclude transactional and security email. Password resets, magic links, OTPs, and 2FA codes should never include a BCC.
  • Match BCC scope to the use case. For Trustpilot AFS, only BCC the Trustpilot address on transactional sends that should generate review invitations, not on every marketing email.

​
Common failure points

OneSignal does not retry BCC delivery failures. If a BCC address is misspelled, mailbox-full, or rejected by the receiving server, the message is dropped silently. Send a manual test to each address before relying on it.
BCC sends count toward your total email volume but are excluded from open and click rates. If your total sends rose without a matching rise in engagement, the new volume is likely BCC traffic. Compare engagement against the primary recipient count, not the total send count.
Each entry in the bcc array must be a bare, syntactically valid email address. Remove extra whitespace, stray punctuation, and display-name formatting like Name <email@domain.com>.
When sending to a large audience, a small or shared BCC inbox can reach capacity before the send completes. Once the inbox is full, remaining BCC deliveries fail silently with no retry or alert. Primary recipients are not affected. Use a dedicated inbox with adequate storage, or configure auto-archiving or auto-delete rules to keep the mailbox clear.
Suppression rules apply only to the primary audience. BCC bypasses the suppression list. Remove the address from your BCC list manually if it should no longer receive copies.

​
FAQ

​
Can I set a default BCC address for every email?

No. BCC must be set per message in the dashboard or per request in the API. There is no account- or app-level default.

​
Are BCC recipients shown to the primary recipient?

No. BCC stands for “blind carbon copy.” Each BCC recipient sees only their own address, and BCC recipients cannot see one another.

​
Do BCC addresses respect my suppression list?

No. The suppression list applies to your primary audience. Do not add a suppressed address to BCC for compliance; the message will still be delivered.

​
Are BCC sends included in analytics?

BCC sends count toward your total email volume so billing reflects the true volume. They are excluded from engagement metrics like open and click rates because BCC inboxes are typically archives, not engaged readers.

​
What happens if a BCC address bounces?

The BCC delivery is dropped. OneSignal does not retry, does not surface a bounce event for the BCC recipient, and does not affect the primary recipient’s delivery. Test BCC addresses before relying on them.

Email overview

Full guide to sending, scheduling, and tracking email.

Create message API

Reference for the email send endpoint and all available parameters.

Suppressions

Manage blocked and suppressed email addresses.

Event Streams

Stream email events to your data warehouse for compliance archiving without adding billable sends.