Email is optional. Without it, the server starts and works normally but sends nothing. The app then hides features that need email: sign-up codes, Forgot password, the recovery phrase reset code and the email alert settings. People can't reset a forgotten password.
What your server sends
- Codes for sign-up, email verification, password reset and recovery phrase reset.
- An "already have an account" email when someone signs up with an address that's already registered.
- A "sign in with Google" email when someone asks to reset the password of an account that only uses Google.
- Security alerts. Alerts for password and recovery phrase changes, other sessions being signed out, alerts being turned off and account deletion are always sent. People can turn off new device and deletion scheduled alerts.
Emails are HTML with a plain-text version. The logo is attached, so nothing loads from the internet: no remote images, tracking pixels or click tracking. A footer line shows SERVER_NAME.
Turn email on
Set one provider and EMAIL_FROM, the sender address. Setting both Resend and SMTP stops the server from starting.
- Verify your sending domain in Resend.
- In the domain's settings, turn off open tracking and click tracking.
- Set
RESEND_API_KEY. A sending-only key works.
With a full-access key, the server checks at startup that the domain is verified and tracking is off, and won't start otherwise. A sending-only key can't check this, so check it yourself.
Give the scheduled job runner the same email settings and REDIS_URL, so it can send the account deleted email at the end of the grace period.
Limits
- Each address can request 3 codes of each kind every 15 minutes.
- Each account can trigger at most 20 emails an hour. Above that, optional emails are dropped; codes and always-on alerts are still sent.
EMAIL_CODE_IP_LIMIT=truealso limits each IP address to 20 code requests an hour. It's off by default because it can block people who share an IP address, such as phones on mobile data or a household on one connection.
Turning email on later
Accounts created while email was off aren't verified. After you turn email on, signing in with a password to one of those accounts sends a code to its address, which the owner enters to finish signing in. Google sign-in isn't affected.
What your email provider sees
Your email provider sees each recipient's address and every email in full, including codes and alert text. Emails never contain locations, IP addresses or recovery material. Anyone who can read an account's email can reset its password, unless it only signs in with Google.