Connect verification emails.

Manual signup, verification codes, sign-in, and password recovery are implemented. Email delivery needs your sender domain and Resend API key.

1. Create a free account at Resend. Review its current free limits at resend.com/pricing. The free plan has a 100-email daily cap; signup, resends, and password recovery all consume quota.
2. Add a domain or a dedicated sending subdomain you own, such as auth.your-domain.com. In your DNS provider, add the exact DKIM and SPF records Resend supplies. Do not replace existing mail records blindly. Wait until Resend marks the domain verified.
3. Create a sending API key. Add these private values to GardenHosting’s .env:

   RESEND_API_KEY=your_private_api_key
   MAIL_FROM=GardenHosting <noreply@auth.your-domain.com>

   The sender address must use the domain you verified. Never put the API key in browser code or paste it into chat.
4. Restart the server, then create an account. Complete verification using the code delivered to your inbox.

How verification works

Codes expire after 10 minutes, can be used once, and allow five guesses. Resends have a 60-second cooldown and per-email limits. Passwords use salted scrypt hashes. A password account is created only after its email code is verified. Password recovery revokes existing sessions.

What is stored

Accounts, hashed passwords, hashed session tokens, verification challenges, and rate-limit counters are stored in the local SQLite database. Raw passwords, verification codes, and email API keys are never returned to the browser or logged. Exported or backed-up database files still contain personal data and must be kept private.

A domain alone does not deliver mail. Resend is the configured transport; no account or paid subscription is created automatically. Delivery has not been tested until you configure a verified sender and API key.