Email Password Authentication

Email/password auth is enabled by default. This page explains how to configure verification and email providers.

Core Features

• ✅ User registration with email verification
• ✅ User login with "remember me"
• ✅ Password reset
• ✅ Account recovery
• ✅ Secure session management

Email Verification Configuration

Configure in config/auth.ts:

export const authConfig = {
  requireEmailVerification: true,
}

Email Service Configuration

When requireEmailVerification is true, the auth system sends verification and password reset emails automatically.

Resend Configuration

1. Sign up at Resend
2. Verify your sending domain
3. Create an API key

RESEND_API_KEY="re_123456789_abcdefghijklmnop"
EMAIL_DEFAULT_FROM="noreply@tinyship.cn"

config/email.ts

export const emailConfig = {
  defaultProvider: 'resend',
}

Cloudflare Email Configuration

Cloudflare Email is now supported for transactional auth mail flows.

Recommended use cases

• Verification emails
• Password reset emails
• Account/security notifications

Do not use it as a bulk marketing sender.

Setup steps

1. Sign in to Cloudflare Dashboard
2. Open Email Sending
3. Complete domain onboarding
4. Confirm required DNS records
5. Create an API token with email sending permissions
6. Prepare a sender address under the enabled domain

Environment variables

EMAIL_DEFAULT_FROM="noreply@tinyship.cn"
CLOUDFLARE_ACCOUNT_ID="your-cloudflare-account-id"
CLOUDFLARE_API_TOKEN="your-cloudflare-api-token"

Provider switch

config/email.ts

export const emailConfig = {
  defaultProvider: 'cloudflare',
}

Important notes

• EMAIL_DEFAULT_FROM must belong to your enabled Cloudflare Email Sending domain
• For deliverability, send both html and text
• Keep transactional and marketing mail on separate domains/subdomains

Smoke test command:

pnpm email:test -- verification --to your-email@example.com --provider cloudflare --name Viking

Development Tips

In local development, you can expose verification URLs from request context:

if (process.env.NODE_ENV === 'development') {
  (request as any).context = (request as any).context || {};
  (request as any).context.verificationUrl = url;
  console.log('[DEVELOPMENT MODE] Verification URL stored in context:', url);
}

Extended Email Use Cases

• Welcome emails
• Notification emails
• System reports
• Security alerts

If you use Cloudflare Email, prioritize transactional use instead of marketing blasts.