Email Providers

Kitbase uses email for password resets, team invitations, and notifications. You can choose between three providers depending on your infrastructure.

Provider	Best for
SMTP	Any SMTP service (Mailgun, SendGrid, Postmark, your own mail server)
AWS SES	Teams already on AWS who want to use IAM credentials instead of SMTP
Resend	Simple API-key setup with no infrastructure to manage

SMTP

Set these variables in your .env:

MAIL_PROVIDER=smtp
MAIL_FROM=noreply@yourdomain.com

SMTP_HOST=smtp.mailgun.org
SMTP_PORT=587
SMTP_USERNAME=your-username
SMTP_PASSWORD=your-password

Works with any SMTP server. Default port is 587 with STARTTLS.

AWS SES

Set these variables in your .env:

MAIL_PROVIDER=ses
MAIL_FROM=noreply@yourdomain.com

SES_ACCESS_KEY=AKIA...
SES_SECRET_KEY=...
SES_REGION=us-east-1

Prerequisites

1. The MAIL_FROM address (or its domain) must be verified in SES.
2. If your SES account is still in the sandbox, recipient addresses must also be verified. Request production access to lift this restriction.
3. The IAM user needs the ses:SendEmail permission.

Minimal IAM policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ses:SendEmail",
      "Resource": "*"
    }
  ]
}

Resend

Set these variables in your .env:

MAIL_PROVIDER=resend
MAIL_FROM=noreply@yourdomain.com

RESEND_API_KEY=re_xxxxxxxxx

Prerequisites

1. Create an API key at resend.com/api-keys.
2. The domain in MAIL_FROM must be verified in Resend. For testing, use onboarding@resend.dev.

Switching Providers

To switch from one provider to another:

1. Edit your .env and change MAIL_PROVIDER to the new provider (smtp, ses, or resend).
2. Add the required variables for the new provider (see sections above).
3. You can leave the old provider's variables in place — they will be ignored.
4. Restart the backend:

docker compose up -d backend

Example: switching from SMTP to Resend

# Change provider
MAIL_PROVIDER=resend

# Add Resend config
RESEND_API_KEY=re_xxxxxxxxx

# Old SMTP vars can stay — they're ignored when MAIL_PROVIDER=resend
SMTP_HOST=smtp.mailgun.org
SMTP_PORT=587

Then restart:

docker compose up -d backend

Verifying Email Delivery

After configuring your provider, test by inviting a team member or resetting a password. Check the backend logs for confirmation:

docker compose logs -f backend | grep -i email

You should see lines like:

Invitation email sent successfully to: user@example.com

If emails are failing, the logs will show the error from the provider (e.g., invalid credentials, unverified sender address).