Resend Authentication: API Key Setup & Security (2026)

Authentication overview

Resend employs a straightforward authentication mechanism centered on API keys. This approach allows developers to integrate Resend's email services into their applications while maintaining secure access control. Each API key is associated with a specific Resend project and can be configured with varying levels of permissions, adhering to the principle of least privilege. All API requests to Resend must be made over HTTPS to ensure that data, including authentication credentials, is encrypted in transit and protected from interception.

The system is designed to be developer-friendly, aligning with modern API security practices. By using API keys as bearer tokens, Resend provides a consistent and widely understood method for authenticating requests, compatible with various programming languages and HTTP clients. This method is common across many web APIs, including those from Stripe's API documentation and Cloudflare API tokens, simplifying integration for developers familiar with these patterns.

Supported authentication methods

Resend primarily supports API key authentication. This method involves generating a unique, secret key from your Resend dashboard and including it in the Authorization header of your HTTP requests. The API key acts as a bearer token, granting access to the resources defined by its permissions.

The use of API keys as bearer tokens is a standard practice for server-to-server and backend-to-API communication. The OAuth 2.0 Bearer Token Usage specification outlines the general principles for this type of authentication, emphasizing the importance of secure transmission. Resend's implementation aligns with these established patterns, providing a robust and familiar security layer for API interactions.

Getting your credentials

To authenticate with the Resend API, you need to generate an API key from your Resend dashboard. Follow these steps to obtain your credentials:

1. Log in to the Resend Dashboard: Access your account at resend.com/login.
2. Navigate to API Keys: In the dashboard, locate the "API Keys" section. This is typically found under settings or a dedicated "Developers" menu.
3. Create a New API Key: Click the "Create new API Key" button.
4. Configure Key Details:
   • Name: Provide a descriptive name for your API key (e.g., "MyWebApp-Production" or "AnalyticsService-Dev"). This helps in identifying the key's purpose later.
   • Permissions (Optional but Recommended): Select the specific permissions for the key. Resend allows you to define what actions the key can perform (e.g., send_emails, manage_domains). Adhering to the principle of least privilege is crucial for security. Grant only the necessary permissions.
   • Domain (Optional): Associate the key with a specific domain if your project manages multiple domains.
5. Generate Key: Confirm your settings and generate the key. Resend will display the secret API key once. Copy this key immediately, as it will not be shown again for security reasons. If you lose it, you will need to revoke it and generate a new one.
6. Store Securely: Store your API key securely. Avoid hardcoding it directly into your application code. Instead, use environment variables, secret management services (like AWS Secrets Manager or Google Secret Manager), or a secure configuration file.

For detailed, step-by-step instructions, refer to the Resend documentation on creating API keys.

Authenticated request example

Once you have your API key, you can use it to authenticate your requests to the Resend API. The key should be included in the Authorization header with the Bearer scheme.

HTTP Request Header

Authorization: Bearer YOUR_RESEND_API_KEY
Content-Type: application/json

Example using Node.js (with fetch)

This example demonstrates how to send an email using the Resend Node.js SDK, which handles the authentication header automatically when initialized with your API key.

import { Resend } from 'resend';

const resend = new Resend(process.env.RESEND_API_KEY);

async function sendWelcomeEmail() {
  try {
    const { data, error } = await resend.emails.send({
      from: 'Acme <[email protected]>',
      to: ['[email protected]'],
      subject: 'Hello from Resend!',
      html: '<strong>It works!</strong>',
    });

    if (error) {
      console.error({ error });
      return;
    }

    console.log({ data });
  } catch (err) {
    console.error('Failed to send email:', err);
  }
}

sendWelcomeEmail();

In this Node.js example, process.env.RESEND_API_KEY refers to an environment variable where your secret API key is stored. This is the recommended practice for handling sensitive credentials in development and production environments.

Example using curl

For direct HTTP requests or testing purposes, you can use curl:

curl -X POST https://api.resend.com/emails \
  -H 'Authorization: Bearer YOUR_RESEND_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "from": "Acme <[email protected]>", "to": ["[email protected]"], "subject": "Hello from Resend!", "html": "<strong>It works!</strong>" }'

Replace YOUR_RESEND_API_KEY with your actual API key and adjust the from, to, subject, and html fields as needed for your specific email content. This curl command directly interacts with the Resend Send Email API endpoint.

Security best practices

Securing your Resend API keys is paramount to prevent unauthorized access to your email sending capabilities and protect your sender reputation. Adhere to these best practices:

• Treat API Keys as Secrets: Your API key grants full access to your Resend account's capabilities within its defined permissions. Never expose it in client-side code, public repositories, or unsecured logs.
• Use Environment Variables: Store API keys in environment variables rather than hardcoding them directly into your application. This keeps them out of your source code and allows for easy rotation across different deployment environments (development, staging, production).
• Implement Least Privilege: When creating API keys, grant only the minimum necessary permissions. For example, if an application only needs to send emails, do not grant it domain management or analytics access. This limits the damage if a key is compromised.
• Key Rotation: Regularly rotate your API keys. Establish a schedule for generating new keys and revoking old ones. This minimizes the window of opportunity for a compromised key to be exploited.
• Monitor API Key Usage: Regularly review your Resend dashboard for any unusual activity or unexpected API key usage patterns.
• Secure Your Development Environment: Ensure that your local development environment and CI/CD pipelines handle API keys securely, preventing accidental exposure.
• Use HTTPS/TLS: All communication with the Resend API automatically occurs over HTTPS, ensuring that your API key and email content are encrypted during transit. Always verify that your application is using HTTPS for all outbound API calls.
• Avoid Public Repositories: Never commit API keys or files containing them (e.g., .env files) to public version control systems like GitHub. Use .gitignore to exclude such files.
• Consider IP Whitelisting (if available/applicable): If Resend offers IP whitelisting for API keys, use it to restrict API access only to requests originating from your trusted server IP addresses. This adds an extra layer of security. (Note: Check Resend's official documentation for current feature availability regarding IP whitelisting.)
• Error Handling: Implement robust error handling in your application to gracefully manage authentication failures without exposing sensitive information.

By following these guidelines, you can significantly reduce the risk of unauthorized access and maintain the security of your Resend integration. The principles of secure credential management are fundamental to any application interacting with external APIs, as highlighted by security guidelines from organizations like Google Cloud's security best practices for API keys.