Resend

Resend works with pg_relay two ways: over the SMTP transport, or over the webhook transport against its Emails REST API. Both authenticate with the same API key, created in the Resend dashboard — keep it out of the database with an _env: reference (Keeping Secrets Out of the Database).

Over SMTP

{
  "host": "smtp.resend.com",
  "port": 587,
  "security": "starttls",
  "auth": "plain",
  "username": "resend",                       // literally the string "resend"
  "password": "_env:RESEND_API_KEY",
  "from": "[email protected]",            // an address on a verified domain
  "timeout_seconds": 30
}

The username is the literal string resend; the password is the API key itself. Port 465 with security: tls also answers. The message block is the standard one from the SMTP chapter.

Over the REST API (webhook)

// profile
{
  "url": "https://api.resend.com/emails",
  "auth": {"style": "bearer_header", "secret": "_env:RESEND_API_KEY"},
  "timeout_seconds": 30
}

// message — Resend's own request shape, sent verbatim
{
  "from": "Notify <[email protected]>",
  "to": ["[email protected]"],
  "subject": "disk alert",
  "text": "volume is filling",
  "html": "<p>volume is filling</p>"
}

For Resend, have classify_webhook_response treat:

• 200 as sent — the JSON body is {"id": "..."}, the sent email's id; return it as the provider reference.
• 429, any 5xx, and http_status = 0 (no response) as retry — Resend rate-limits per second, so 429 on a burst of notifications is routine and self-heals through the retry chain.
• Any other 4xx as failed — a bad key, a malformed body, an unverified sending domain.

Things Resend enforces

from must be on a domain you have verified in the Resend dashboard (DNS records added and confirmed). Until a domain is verified, Resend only permits its onboarding test address, which is fine for a first smoke test and nothing more.

---

Continue to Slack.