Providers / Resend
Resend API keys and credentials
What every Resend credential a founder holds does, whether it expires, and what tends to break. Each fact links to Resend's own docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| Resend dashboard login | Not documented | – |
| Full access API key | Not documented | Can be scoped |
| Sending access API key (optionally domain-restricted) | Not documented | Can be scoped |
Each credential
Resend dashboard login
- Not documented
Dashboard login. Password/2FA policy not confirmed in sources.
Full access API key
- Not documented
- Can be scoped
Full access grants create, get, update and delete on any resource. The key value cannot be viewed or edited after creation, so it must be stored at creation. Keys can be listed via the API. The dashboard exposes no expiry setting, but no expiry behavior is documented either. Rotate by creating a new key and deleting the old one.
Sending access API key (optionally domain-restricted)
- Not documented
- Can be scoped
Sending access allows sending emails only. It can be restricted to one domain at creation (domain_id via the API, domain selection in the dashboard). Name, permission and domain can be edited later; the key value cannot.
What usually goes wrong
- Sending-access key restricted to one domain fails when used to send from another domain
- Key value is shown only once; a lost key must be replaced in every application using it
- Free plan daily cap of 100 emails causes send failures on high-volume days
Renewals and billing
- Resend paid plan (Pro or Scale), billed monthly. Pro from $20/mo for 50,000 emails; Scale from $90/mo. Self-serve plans are billed monthly only. Free plan is capped at 100 emails per day.
Monthly plan with pay-as-you-go overage in buckets of 1,000 emails (must be enabled in team settings).
Where to find it in Resend
- Open Resend domains
- Open Resend API keys
- Resend guide to adding a domain and its DNS records
- Resend DMARC guide
What Resend's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- Whether API keys ever expire (no expiry option documented; not explicitly stated as never)
- Whether the list-keys response includes creation or last-used dates
- Domain verification re-check requirements over time
- Billing details beyond the pricing page summary
Rotating or replacing a Resend key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
- resend.com/docs/dashboard/api-keys/introduction
- resend.com/docs/create-an-api-key
- resend.com/changelog/new-api-key-permissions
- resend.com/pricing
- resend.com/docs/api-reference/domains/get-domain
- resend.com/docs/api-reference/domains/verify-domain
- resend.com/docs/api-reference/api-keys/create-api-key
- resend.com/docs/dashboard/domains/cloudflare
- resend.com/docs/api-reference/domains/create-domain
- resend.com/docs/add-a-domain
- resend.com/docs/dashboard/domains/introduction
- resend.com/docs/dashboard/domains/dmarc
- resend.com/docs/dashboard/domains/custom-return-path
Related providers
Keep track of every Resend key
StackHangar stores your Resend keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.