Resend API keys (re_) are server-only. Create keys with sending access restricted to a single verified domain, send from server or edge code, and verify webhook signatures before trusting delivery events.
Can only send email, optionally from one domain.
Manages domains, keys, and audiences.
Verifies Svix-signed webhook deliveries.
Limit blast radius if a key leaks from logs or config.
Check the svix-signature header before updating bounce or complaint state.
The key becomes public and attackers can send mail from your domain.
Fix the sender on the server to protect your domain reputation.
Store RESEND_API_KEY in the vault and expose a POST pipeline with a fixed sender and template, protected by a client token.
No. Use a sending access key for app traffic and reserve full access for admin tooling.
Framer generates pure React client components where hardcoded API keys are visible to anyone viewing browser source code. Route requests through RealComposer to inject secrets at the edge and enforce domain origin protection.
Static sites have no server to hold RESEND_API_KEY. RealComposer provides a zero-maintenance edge proxy that receives form submissions from your static HTML site and sends emails via Resend with sub-50ms latency.
Webhook signature verification is validating that an incoming webhook was sent by the expected provider and was not altered. Providers sign each payload with a shared secret, typically using HMAC-SHA256, and your endpoint recomputes the signature and compares it before trusting the event.
Principle of Least PrivilegeThe principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.
API KeyAn API key is a unique secret string that identifies the application calling an API and authorizes its access. Providers use keys to authenticate requests, enforce quotas, and bill usage. Anyone holding the key can act as your application, so secret keys must stay on trusted servers.