Sending email
A workspace can hold several email configurations, each with its own provider and recipients. One is the default, a form can name a different one, and secrets never come back out of the API.
Email is configured per workspace, and a workspace can hold more than one configuration - "Sales", "Support", "Newsletter" - each with its own provider, sender identity and recipients. That is the point: a contact form and a careers form should not have to land in the same inbox.
Providers
Four, and the choice is per configuration rather than per workspace:
- Resend, SendGrid, Mailgun - an API key, and for Mailgun a domain and a region (
usoreu, which matters if your data has to stay in Europe). - SMTP - host, port, username, password, TLS on by default. The escape hatch for a corporate relay or a provider nobody has integrated.
Every configuration also carries the sender identity - from address, from name, and an optional reply-to - plus the list of recipients that notifications for it should reach.
The default, and overriding it
One configuration is the default: anything that sends without naming a configuration uses it. A form can name a different one, which is how the careers form reaches recruiting while everything else goes to the general mailbox.
A configuration can also be deactivated rather than deleted, which is the right move when you are rotating a provider and want the old settings kept while you cut over.
Test before you trust it
Each configuration has a test send. Use it. Email fails in ways that only show up in transit - a rejected sender domain, an API key with the wrong scope, a relay that quietly refuses anything without authentication - and the alternative to a test send is discovering it from the customer whose enquiry never arrived.
Secrets do not come back out
You write an API key or an SMTP password in; you never read one out. The API returns the key masked to its last four characters, and for SMTP it returns only whether a password is set at all.
This is worth knowing before you plan around it: there is no "show me the current password" - if nobody wrote it down, the way forward is a new key from the provider, not a recovery from cmssy.
Next steps
- Forms - the submissions that most often need a configuration of their own.
- Comments and tasks - mentions and assignments that arrive by email too.