HALODocs
Dashboard
Authentication

Email & Resend

Email/password, confirmation, recovery, and templates.

HALO sends project Authentication email directly through the project's Resend key. Generic SMTP and arbitrary email delivery webhooks are not part of the production contract.

#Email settings

  • Enable or disable email Authentication and public signup separately.
  • Choose whether email confirmation is required before a session.
  • Set minimum length and uppercase, lowercase, number, and symbol rules.
  • Set a site URL and an exact allowlist of redirect URLs.

#Configure Resend

  1. 1
    Verify a sending domain

    Add and verify the domain in Resend before selecting a From address.

  2. 2
    Create a restricted key

    Create a Sending access key beginning with re_. Prefer a domain-restricted key.

  3. 3
    Save project delivery

    Set From name, verified From address, paste the key, and enable delivery.

#HTML templates

Confirmation, password recovery, and invitation each require a subject and HTML body. HTML is sent as configured through Resend.

VariableValue
{{ .ConfirmationURL }}Required verification or recovery link
{{ .Email }}Recipient email
{{ .SiteURL }}Configured project site URL
{{ .ProjectID }}Project identifier
{{ .Purpose }}confirmation, recovery, or invite
<!doctype html>
<html>
  <body style="font-family: sans-serif; color: #111">
    <h1>Confirm your account</h1>
    <p>Finish signing in as {{ .Email }}.</p>
    <p><a href="{{ .ConfirmationURL }}">Confirm email</a></p>
  </body>
</html>

#Confirmation & recovery

GET/api/v1/auth/verify
POST/api/v1/auth/recover
POST/api/v1/auth/password/reset

Redirect targets must be the configured site URL or an exact allowed redirect. HALO does not accept an arbitrary URL supplied by the user.

#Rate limits

Configure hourly signup, login, and recovery limits. Limits are project-scoped and discriminator-aware. Authentication fails closed with a 503 if the rate limiter is unavailable.