Getting started
Scanhive makes your printer's scan to email button work again — and routes scans to storage, drives, and apps. Setup takes about two minutes:
- Create an account at app.scanhive.net.
- Add a printer — you get a server address, username, and password (shown once).
- Enter those on the printer in its scan-to-email / SMTP settings (see printer setup).
- Add a recipient — every address that should receive scans confirms by email first.
- Add a destination and a rule under Routes — email, cloud storage, SFTP, and more.
- Press the scan button. That's it.
Printer setup
Enter these in your printer's scan-to-email (SMTP) settings. The menus differ by brand — look for Network → E-mail, Scan settings, or SMTP:
| SMTP server | smtp.scanhive.net |
| Port | 587 (or 25) |
| Encryption | STARTTLS if offered — plain works for older devices |
| Authentication | SMTP AUTH (LOGIN or PLAIN) |
| Verify server certificate | Off (recommended — see below) |
| Username | from your dashboard, e.g. prn_ab12cd34 |
| Password | shown once when the printer is added (rotate any time) |
The From address
Whatever "From" your printer is configured with, Scanhive rewrites the sender to a verified domain so modern mailboxes accept it. The original sender is kept in Reply-To and the display name.
Recipients & allowlist
Scans are only emailed to addresses on your verified allowlist. When you add a recipient, they get a confirmation email; until they click it, that address is unverified.
A scan to an unverified email address isn't rejected at the printer — it's accepted and held, and shown in your dashboard so you can approve the recipient (which sends them the confirmation link). Once they confirm, the held scan is delivered automatically. This keeps Scanhive from being an open relay while never losing a scan to a cryptic printer error. The allowlist only governs email delivery — scans routed to storage, drives, or SFTP don't depend on it.
Destinations
A destination is a place scans can go. Add them in the dashboard under Routes:
| Type | What it does |
|---|---|
email | Delivers to the scanned-to address (or a fixed list) from a verified domain |
vault | Scanhive's own encrypted store — powers the web inbox and archive |
s3 | Your own S3-compatible bucket |
gdrive / onedrive / box | Cloud drives, connected via OAuth |
dropbox | Dropbox folder (access token) |
sftp / ftp | Any SFTP or FTP(S) server |
webdav | Nextcloud, ownCloud, or any WebDAV server |
paperless | Paperless-ngx document management |
webhook | HTTPS POST to your app, HMAC-SHA256 signed |
slack | A note in a Slack channel per scan |
Destination credentials are encrypted at rest with a key unique to your organisation, and are never returned by the API once saved.
Routing rules
Rules decide which destinations each scan goes to. A scan can fan out to several destinations at once; a rule with no conditions matches every scan.
- Applies to — every printer, or specific ones.
- Subject contains — e.g. route scans whose subject contains
invoiceto your accounting inbox. - Priority — lower numbers evaluate first; a rule can stop evaluation when it matches.
File naming
Storage destinations support folder and filename templates with tokens:
{date} {time} {subject} {sender} {message_id} {filename} {stem} {ext} {n}
e.g. folder {date} + filename {date} {subject} {n}{ext} → 2026-07-21/2026-07-21 Invoice 1.pdf.
Security & GDPR
- No open relay — every recipient is verified by double opt-in before delivery.
- Antivirus — every attachment is scanned; infected messages are rejected, never delivered.
- Deliverability — mail is sent from a verified domain with SPF and DKIM aligned.
- Storage is opt-in — without a storage destination, scans pass through and are not kept.
- Encryption — stored documents and destination credentials are encrypted at rest with per-organisation keys; transport is TLS end-to-end from Scanhive onward.
- Tenant isolation — enforced in the application and again at the database layer (row-level security).
- GDPR — data hosted in the UK/EU; audit trail per scan; DPA available on paid plans.
API
Everything the dashboard does is available at https://api.scanhive.net. Authentication is session-cookie based: POST /v1/auth/login, then send the cookie with each request. Multi-org accounts scope requests with an X-Org-Id header.
curl -c jar -X POST https://api.scanhive.net/v1/auth/login \
-H 'Content-Type: application/json' \
-d '{"email":"[email protected]","password":"…"}'
curl -b jar https://api.scanhive.net/v1/printers
| Area | Endpoints |
|---|---|
| Auth | POST /v1/auth/register · login · login/mfa · logout · GET /v1/auth/me · password forgot/reset/change · optional TOTP MFA |
| Printers | GET/POST /v1/printers · DELETE /v1/printers/{id} · POST /v1/printers/{id}/rotate |
| Recipients | GET/POST /v1/recipients · DELETE …/{id} · POST …/{id}/resend |
| Destinations | GET/POST /v1/destinations · PATCH/DELETE …/{id} |
| Routes | GET/POST /v1/routes · DELETE …/{id} |
| Activity | GET /v1/messages?limit=50 |
| Usage | GET /v1/usage |
| Team | GET /v1/users · invites create/accept/revoke |
Webhook deliveries are signed with HMAC-SHA256 over the request body using your webhook's secret; verify the Scanhive-Signature: sha256=<hex> header before trusting a payload.