Connect Resend
An account of Resend is connected once, on the instance, by a person who then gives missions access to its resources; the agent never receives the credential. Outbound email : transactional sends classified by recipient zone, segments and contacts, broadcast campaigns, sending domains — one resource per domain and per segment.
One account is one Resend API key; resources are its sending domains and its contact segments. Sends are told apart by who the email goes to (internal, allow-listed, anyone), and the owner of the account labels each domain and segment with an environment so that staging and production are held separately.
Permissions, presets and tools of this service: Resend plugin.
How to connect
On the instance: Accounts → Connect an account, then pick the service. A company app, when the service needs one, is registered once by an administrator under Settings → Administration → Company apps, or set in the configuration (providers.<id>.*, see configuration keys). Every instance registers its own app: this gateway never uses an app shared with another one.
The usual way: with a key pasted by hand
Where: https://resend.com/api-keys
What the connect page asks:
- API key (secret): A key with "Full access" : resource discovery lists the domains and segments, which a "Sending access" key cannot read. Recipient zones are configured per domain resource after connection.
Disconnecting
Delete the API key in the Resend dashboard, under API Keys.
Registration notes from the plugin
From the plugin's README, written for the people who register the app or create the token.
Credential and resources
Kind api-key, one secret field:
| Field | Pattern | Purpose |
|---|---|---|
api_key | ^re_[A-Za-z0-9_-]+$ | A Full access key created at https://resend.com/api-keys |
There is no company-registered app for Resend: the owner creates the key in
the Resend dashboard and pastes it. A Sending access key cannot list
domains or segments, so discovery refuses it (UpstreamAuthError).
discoverResources pages through GET /domains and GET /segments (100 per
page, at most 500 per kind) and returns:
{ provider: 'resend', ref: 'notifications.acme.com', displayName: 'notifications.acme.com',
metadata: { kind: 'domain', domain_id: 'd91c…', status: 'verified', region: 'eu-west-1',
internal_domains: [], allowlist_domains: [], allowlist_addresses: [] } }
{ provider: 'resend', ref: '7826…', displayName: 'Newsletter',
metadata: { kind: 'segment', segment_id: '7826…' } }
The recipient zones of a domain live in its resource metadata and start
empty, which is the safe default: until the owner fills them, every
recipient is external-unbounded. The owner edits the three lists (exact
domain or address match, case-insensitive) and labels the environment of
each resource. A host that re-runs discovery must preserve those edits.