Integration

Resend Integration

Configure Resend for magic-link auth, email campaigns, and lifecycle workflows.

Resend is a developer-first transactional email API for sending, tracking, and managing mail without running your own SMTP. TanStack Ship uses Resend for:

  • Magic-link sign-in — one-time login links after email entry (src/lib/auth.ts)
  • Email campaigns — admin HTML campaigns delivered via Cloudflare Queues (email-campaign-queue)
  • Lifecycle workflows — automated sequence emails (workflow-queue)

Important

Pushing to GitHub does not update production secrets. Set RESEND_API_KEY in .dev.vars (local) or via wrangler secret put (production).

Sign Up & API Key

  1. Register at resend.com
  2. Go to API Keys → Create API Key
  3. Copy the key starting with re_
  4. Add to local .dev.vars:
bash
RESEND_API_KEY=re_xxxxxxxx
  1. For production:
bash
pnpm wrangler secret put RESEND_API_KEY

Good to know

The API key is equivalent to send credentials. Never commit it or expose it in client code. Revoke and rotate immediately if leaked.

Configure EMAIL_FROM

EMAIL_FROM sets the display name and address recipients see:

bash
EMAIL_FROM="TanStack Ship <no-reply@your-domain.com>"
RequirementNotes
Domain verificationDomain after @ must show Verified in Resend Domains
Display nameQuote when it contains spaces, e.g. "My App <no-reply@example.com>"
Production storageNon-sensitive; can live in wrangler.jsonc → vars or as a secret

Domain & DNS Verification

Add a Domain

  1. Resend Dashboard → Domains → Add Domain
  2. Enter your sending root domain (e.g. your-domain.com)
  3. Add DNS records as shown (typically SPF, DKIM, etc.)
  4. If DNS is on Cloudflare, try Sign in to Cloudflare to import the first three records
  5. Add the _dmarc record manually in Cloudflare DNS
  6. When all pass, Status is Verified

Good to know

If verification stalls, click Restart on the Domains page. Keep email DNS records DNS only (grey cloud) — proxying can break verification.

DMARC Phased Policy

PhaseRecord valuePurpose
Monitorv=DMARC1; p=none; rua=mailto:dmarc@your-domain.com; pct=100Collect reports only
Quarantinev=DMARC1; p=quarantine; rua=mailto:dmarc@your-domain.com; pct=100Failures go to spam
Rejectv=DMARC1; p=reject; rua=mailto:dmarc@your-domain.com; pct=100Block spoofed mail

Replace rua with a real mailbox for aggregate reports.

Usage in Code

Magic links call the Resend API synchronously during auth:

typescript
// src/lib/auth.ts
const resend = new Resend(requireEnv('RESEND_API_KEY'))
await resend.emails.send({
  from: requireEnv('EMAIL_FROM'),
  to: input.email,
  subject: 'Your sign-in link',
  html: `<p><a href="${url}">Sign in</a></p>`,
})

Bulk campaigns run in the Queue consumer — see src/server/email-campaign-queue.ts.

Good to know

TanStack Ship does not use RESEND_SEGMENT_ID. Manage contacts in Resend Audiences or send marketing mail via Dashboard Broadcast.

Environment Variables

VariableSecretLocalProduction
RESEND_API_KEY✓.dev.varswrangler secret
EMAIL_FROM.dev.varswrangler.jsonc vars

Full reference: Environment Variables.

Verification Checklist

After setup, confirm:

  1. Enter email on sign-in page → magic link triggered
  2. Resend → Emails shows Delivered
  3. Resend → Logs shows the API request
  4. Inbox receives mail; link completes sign-in
  5. (Optional) Create a test campaign in admin /dashboard/admin/... and confirm Queue consumption

Warning

If local works but production fails, check wrangler secret list for RESEND_API_KEY and that EMAIL_FROM domain is Verified in production too.

Related Docs