Resend
Resend is a transactional email service. It's the bit of an app that sends the emails users actually expect: a sign-up confirmation, a password reset link, a receipt after a purchase. If your app has accounts or payments, it almost certainly needs to send email, and Resend is how Appsanic does it.
Connect Resend from the connectors surface inside the project build. The connection applies only to that project and requires a paid plan.
What you get by connecting it
With a Full access Resend key connected and Account access switched on, the agent can use the eligible server-side domain action without putting your API key in the model prompt:
- Registers your sending domain so mail goes out from your own address rather than a shared sandbox one.
- Hands you the DNS records to add - the provider-supplied entries you publish at your DNS host so Resend can verify the domain.
- Guides runtime-key setup after domain registration. You create a scoped sending key in Resend and add it directly to the deployed mail backend's secret manager.
Domain actions land in the connector's AI activity feed with secrets stripped. Creating and provisioning the runtime sending key happens directly in Resend and your backend host, outside Appsanic's activity feed.
Connecting it
You connect Resend by entering credentials in the project's connector form. Connector OAuth is not currently available.
You'll need:
- An API key - starts with
re_, and is server-side only. Use a dedicated Full access key only if you want the bounded domain-registration action. A Sending access key is accepted for authentication-only connection state but cannot enable that action. Find keys in the Resend dashboard under API Keys. - A from address (optional) - the address your app sends from, once your domain is registered.
Then:
- Open the project build and select Connectors → Resend.
- Paste the API key (and the from address if you have one).
- With a Full access connector key, switch on Account access if you want the agent to register a sending domain and return its DNS records. Runtime key creation remains yours: create a separate least-privilege Sending access key in Resend and save it directly in the deployed backend's secret manager. With Account access off, or with a Sending access connector key, the agent writes the setup steps for you to run yourself.
Saved secrets are shown as dots - the stored key never round-trips back to browser JavaScript. Test now reports whether domain access was verified or the key was accepted as authentication-only; it never sends an email. Use Disconnect (behind a confirmation) to remove the project's encrypted copy.
Keys and security
Resend API keys are server secrets. A Sending access key can send mail; a Full access key can reach broader account resources. Neither belongs in an app people download. With a Full access connector key and Account access enabled, the build agent can register a domain through one narrow server-side action. It deliberately cannot mint or reveal an API key. Your published app must call a separately deployed mail backend whose separate Sending access runtime key you created and provisioned yourself.
The saved API key is encrypted at rest with AES-256-GCM. Browser JavaScript sees only that it exists, while the non-secret default From address may remain visible. The model prompt never receives the API key. Revoke and replace any key that enters chat.
Useful links
- Resend documentation: https://resend.com/docs
- Appsanic guide: Sending Email
Next
Read Sending Email for how to actually send confirmations, resets, and receipts from your app.