PushHub Email Delivery

Provider strategy

PushHub sends transactional email through the backend IEmailService.

Production priority:

1. Resend API, when RESEND_API_KEY is configured.
2. SMTP, when EMAIL_SMTP_HOST is configured and Resend is not configured.
3. Log fallback, when neither provider is configured or the setup email provider fails.

The fallback intentionally logs the setup-password CTA for operational recovery, but it does not deliver email to the company owner.

Resend configuration

Required production variables:

EMAIL_FROM_EMAIL=noreply@pushhub.kemegames.com
EMAIL_FROM_NAME=PushHub
RESEND_API_KEY=re_...
RESEND_API_URL=https://api.resend.com/emails

The production Resend account verifies kemegames.com, so the active sender is noreply@kemegames.com. Do not use noreply@pushhub.kemegames.com unless that subdomain is separately added and verified in Resend; Resend rejects an unverified sender domain with HTTP 403.

The sender domain used by EMAIL_FROM_EMAIL must be verified in Resend before real delivery. Configure the SPF/DKIM/DMARC records that Resend provides for the domain, then verify the domain in the Resend dashboard.

Trial approval behavior

When a Keme admin approves a trial request:

1. PushHub provisions the company, inactive owner user, owner membership, and setup-password token.
2. PushHub sends the setup-password CTA through Resend when RESEND_API_KEY is configured.
3. PushHub records the setup-email outcome on the trial request: Sent, Fallback, or Failed, plus attempt count, provider, provider message id when available, attempt time, and last error.
4. If delivery is not configured or fails, PushHub logs [EMAIL:FALLBACK] with the setup CTA so support can recover manually.

Approved requests can also use the Keme Admin Resend setup action. This creates a fresh setup-password token, invalidates existing open setup tokens for the owner, and sends the new CTA through the configured email provider.

Approved requests can use the Keme Admin Setup link recovery action when real email is blocked. This is a super-admin-only manual fallback. It creates a fresh seven-day setup-password token, invalidates older open setup tokens for the owner, audits the action, and returns the raw setup URL only in that response. Do not paste this link into shared tickets or documentation.

Verification

After configuring Resend:

1. Recreate the API container so it receives the new env variables.
2. Submit a trial request from the marketing website.
3. Approve it in Keme Admin.
4. Confirm API logs contain [EMAIL:RESEND].
5. Confirm the recipient receives the setup-password email.
6. Confirm Keme Admin shows setup email status Sent.

For an already-approved request, open Keme Admin → Trial Requests → switch filter to Approved → click Resend setup.

If Resend is not configured yet, the admin table should show Manual action. Use Setup link only as an operational recovery path while DNS/API-key setup is being completed.

Administrator invitations

Only an active Owner can invite another Keme operator. The email contains a single-use activation CTA valid for three days and identifies the assigned role. PushHub stores only the SHA-256 hash of the invitation token; the raw token exists only in the delivery URL. Sending a replacement invitation revokes the older open invitation for that email.

The recipient opens /admin/accept-invitation, chooses a strong password, and activates a named administrator identity. Invitation creation and acceptance are audited. Invitation email delivery uses the same Resend/SMTP configuration and verified sender as password recovery and trial onboarding.

Administrator security alerts

The same provider sends security alerts after an administrator lockout, password reset, MFA disablement, role change, or Owner-initiated unlock. Alerts never contain passwords, MFA secrets, recovery codes, session tokens, or raw recovery links. Provider failures are logged without rolling back the security control that triggered the message.

Password recovery delivery

Workspace and Keme administrator recovery use the same configured Resend transport as trial onboarding. Recovery emails contain a 30-minute, single-use CTA. The API stores only a SHA-256 hash of the URL token, gives the same accepted response for known and unknown addresses, and never writes the raw token to logs. A failed provider call is logged without revealing account existence to the requester; requesting again revokes any older open token before another delivery attempt.

Production verification on September 14, 2026 confirmed a successful administrator recovery delivery through Resend, API health, one open recovery token, and revocation of the superseded token. No password was changed during verification.