Email Provider Integration

Configure email delivery for two-factor authentication codes and notifications via Resend.

Overview

Hygate uses Resend to deliver email one-time passwords (OTPs) for two-factor authentication. When you enable Email OTP or Either Method 2FA, Hygate sends a 6-digit code to the user's email address on each login.

What You Need

A Resend account (resend.com)
A verified sending domain in Resend
A Resend API key

Setup Steps

Step 1: Create a Resend Account

Go to resend.com and create an account
Verify your email address
Verify your sending domain (required for sending to external addresses)

Step 2: Verify Your Domain

In Resend Dashboard, go to Domains
Add your domain (e.g., yourcompany.com)
Add the DNS records Resend provides (MX, SPF, DKIM)
Wait for verification (usually takes a few minutes)

Why verification matters: Resend requires domain verification to prevent spam and ensure deliverability. Without a verified domain, emails may go to recipients' spam folders or be rejected.

Step 3: Create an API Key

In Resend Dashboard, go to API Keys
Click Create API Key
Give it a name (e.g., "Hygate Integration")
Copy the API key

Step 4: Enter in Hygate

Go to Settings → Email
Paste your Resend API Key
Enter your From Email address (must be from your verified domain, e.g., no-reply@yourcompany.com)
Click Test Connection
Check your inbox for the test email
If received, click Save

How Email OTP Works

Login Flow with Email OTP

User enters email + password on login page
        │
        ▼
  Credentials validated
        │
        ▼
  2FA required → system generates 6-digit code
        │
        ▼
  Hygate → Resend API: send email
  Email contains: 6-digit code, expiry time (5 minutes)
        │
        ▼
  User receives email
  Enters code on 2FA screen
        │
        ▼
  Code validated
  Valid: session created, redirected to dashboard
  Invalid: error shown, code expires after 3 attempts or 5 minutes

Code Security

Feature	Detail
6-digit code	1,000,000 possible combinations
Expiry	Code expires after 5 minutes
Attempt limit	Code locked after 3 incorrect attempts
One-time use	Code can only be used once
Per-session	A new code is generated on each login

Email Templates

Hygate sends emails for these purposes:

Email	When Sent	Content
2FA Code	User requests email OTP on login	6-digit code + expiry time
Invitation	Admin invites a new team member	Invitation link + role
Password Reset	User requests a password reset	Reset link + expiry

Troubleshooting

Test Email Not Received

Check	Action
Resend account	Verify your Resend account is active
Domain verified	Check Domains in Resend Dashboard
From email	Ensure the From address matches your verified domain
Spam folder	Check your spam folder
Email address	Verify the recipient email is correct
API key	Ensure the Resend API key is valid

"Connection test failed"

Check	Action
API key	Verify the key is correct (starts with `re_`)
Resend status	Check resend.com for service status
Domain verification	Ensure your domain is verified in Resend
From email	Must be from your verified domain

Email Going to Spam

Fix	How
Verify your domain	Resend requires domain verification for deliverability
Add SPF record	Already included in Resend's DNS setup
Add DKIM record	Already included in Resend's DNS setup
Use a recognized From address	Something like `no-reply@yourcompany.com`

Resend API Errors

Hygate logs email delivery errors. Check audit logs or server logs for details:

invalid_api_key — API key is wrong or revoked
domain_not_verified — Domain verification issue
rate_limit_exceeded — Too many emails sent

Deliverability Best Practices

Use a consistent From address — no-reply@yourcompany.com is recognizable
Verify your sending domain — Required by Resend and improves deliverability
Keep emails transactional — Hygate only sends OTP, invitation, and reset emails
Monitor bounce rates — Check Resend Dashboard for delivery issues
Use HTTPS for Hygate — Ensures email links in Hygate-generated emails are secure

Security Notes

Resend API keys are encrypted at rest in the Hygate database
OTPs are single-use and expire after 5 minutes
OTPs are hashed before storage (not stored in plain text)
Failed delivery does not bypass 2FA — the user cannot proceed without a valid code