Resend API key
Create your email API key and prepare a verified sender when you're ready to deploy.
Resend sends your app's authentication emails, workspace invitations and other messages. You need a Full access API key before Kickstart. You can test locally with Resend's restricted sender, then verify your own sending domain before deployment.
Get your API key
Create an account or sign in at Resend. Use the account that should own your app's email templates and sending domain.
Open API Keys
Choose API Keys in the dashboard, or open the API Keys page directly. Select Create API key and give it a recognizable name, such as My app Kickstart.
Choose Full access
Set the permission to Full access. Kickstart needs to inspect domains and manage email templates as well as send messages. A Sending access key doesn't cover those setup operations.
Authentication and invitation email uses Resend's API-published templates through Supabase's signed Send Email Hook. This is an API-template flow, not SMTP. Kickstart installs the Resend key only as a server-side function secret; keep it out of browser code and Vercel unless a separate server feature needs it.
Create the key and copy its value while it is shown. Save the key itself, not its name or ID. Resend's key management guide explains the permission choices.
Add the key to .env
In your editor, open .env in the main project folder beside package.json. If you haven't created it, copy .env.example to .env. Keep an existing .env and edit it.
Find the existing RESEND_API_KEY= line, paste the key after =, and save:
RESEND_API_KEY=replace_with_your_resend_full_access_keyUse the actual value you copied and keep one RESEND_API_KEY line. Don't add a second assignment at the bottom of the file.
Start with local test emails
On a new installation, leave RESEND_FROM_EMAIL, RESEND_TEST_MODE and the RESEND_TEMPLATE_*_ID fields blank. Kickstart discovers a verified domain or selects the restricted test sender, then publishes the templates and saves their IDs.
With no verified domain, emails from onboarding@resend.dev can only go to the address associated with your Resend account. Use that address to test the app's email flows. If you have several verified domains, Kickstart asks which one to use.
Before emailing other people
Verify a sending domain you control before inviting customers or testing with other recipients. Owning a domain and verifying it for outbound email are separate steps.
Verify a production sender
You can return to this section when your local app works and you're preparing deployment.
- Open Resend Domains and add your domain or a sending subdomain, such as
mail.your-domain.com. - Open the DNS settings where your domain is managed. That's usually where you bought it, such as Namecheap, GoDaddy or Cloudflare. If you changed nameservers, use the provider they point to.
- Add the exact record types, names and values Resend gives you. Each domain has its own verification records.
- Return to Resend and start verification. DNS changes can take from a few minutes to several hours to appear. Use Resend's diagnostics to fix pending or failed records.
- Choose a From address on that verified domain and edit the existing fields in
.env:
RESEND_FROM_EMAIL=noreply@your-verified-domain.example
RESEND_TEST_MODE=falseReplace the example address with your own. If your public contact form should email you, also set CONTACT_TO_EMAIL to an inbox you monitor. Resend's domain guide explains DNS verification. Setting up an outbound sender doesn't create an inbox.
Check that you're ready
For the first Kickstart, a saved Full access key is enough to continue collecting credentials. Once all three are ready, run npm run kickstart:check.
For deployment, you also need verified domain status and the production sender settings above. Follow Deployment Kickstart to apply them. Editing .env alone doesn't update the hosted Auth email hook or an existing production deployment.
Technical reference
Template 0.0.1 · September 2026 source snapshot