Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.refactkit.com/llms.txt

Use this file to discover all available pages before exploring further.

RefactKit delegates all transactional email to Resend, a developer-focused email API. You need a Resend account and an API key to send verification emails, password resets, invitation notices, and security alerts. This page covers obtaining your credentials, setting the required environment variables, and what to expect in development versus production.

​
Prerequisites

  • A Resend account (free tier supports up to 3,000 emails/month)
  • A sending domain you control (required for production only — development works without one)

​
Steps

1

Create a Resend account

Go to resend.com and sign up. You can start sending immediately from Resend’s sandbox domain (onboarding@resend.dev) during development — no DNS changes required at this stage.
2

Create an API key

  1. In the Resend dashboard, click API Keys in the left sidebar.
  2. Click Create API Key, give it a name (e.g., refactkit-dev), and select the appropriate permission scope.
  3. Copy the key — it begins with re_.
Resend only shows the API key once at creation. Copy it immediately and store it in your password manager before leaving the page.
3

Set your environment variables

Add the following to your .env.local file:
RESEND_API_KEY="re_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
EMAIL_FROM="RefactKit <noreply@yourdomain.com>"
EMAIL_FROM controls the sender name and address shown to recipients. In development you can use onboarding@resend.dev as the address. In production it must match a verified domain (see the next step).
RESEND_API_KEY is also used as the SMTP_PASSWORD for SMTP-based sending. See the SMTP configuration section below for details.
4

Verify your sending domain (production)

For production deployments, you must verify the domain in EMAIL_FROM to avoid emails being flagged as spam or rejected.
  1. In the Resend dashboard, click Domains → Add Domain.
  2. Enter your domain (e.g., yourdomain.com).
  3. Resend generates SPF and DKIM DNS records. Add them to your DNS provider (Cloudflare, Route 53, etc.).
  4. DNS propagation typically takes a few minutes to an hour. Resend will confirm when the domain is verified.
Sending from an unverified domain in production will cause emails to land in spam or be blocked entirely by receiving mail servers. Domain verification is mandatory before going live.

​
SMTP configuration

RefactKit also supports SMTP-based sending. Add these variables to your .env.local alongside the Resend API key: 
SMTP_HOST="smtp.resend.com"
SMTP_PORT=465
SMTP_USER="resend"
SMTP_PASSWORD="re_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
SMTP_PASSWORD is your Resend API key. The username is always the literal string resend — not your email address or account name.
VariableValueNotes
SMTP_HOSTsmtp.resend.comResend’s SMTP endpoint
SMTP_PORT465SSL/TLS port
SMTP_USERresendFixed value — always resend
SMTP_PASSWORDre_...Your Resend API key
EMAIL_FROMName <address@domain.com>Must match a verified domain in production

​
Emails sent by RefactKit

RefactKit uses Resend for the following transactional messages:
Email typeTriggerNotes
Email verificationUser signs upSent to confirm the new account’s email address
Password resetUser requests a password resetToken expires in 30 minutes; link is single-use
InvitationAn admin or owner invites a new memberIncludes a link to join the organization
Sign-up alertAn existing email tries to sign up againAnti-enumeration protection — the real account owner is notified silently
The sign-up alert is an OWASP anti-enumeration control. When someone tries to register with an email that already has an account, RefactKit returns the same “Check your inbox” screen to the requester but sends the real account owner a security notice via Resend. This prevents user enumeration attacks.

​
Development vs. production

During development you do not need a verified domain. Use Resend’s sandbox to send test emails to any address:
RESEND_API_KEY="re_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
EMAIL_FROM="RefactKit <onboarding@resend.dev>"
Emails sent in sandbox mode appear in the Resend dashboard → Emails section so you can inspect them without needing a real inbox.