Connect Resend and receive verified events

Automate.ax connects Resend through OAuth 2.1 or a Resend API key. OAuth is preferred, while API keys remain available for accounts that don’t use an OAuth application connection.

Choose Resend access

Resend defines two OAuth scopes: emails:send and full_access. Email and batch-send actions accept either scope. Sending an existing broadcast also accepts either OAuth scope, but Resend API keys require full_access for that action. Every other packaged action and all managed triggers require full_access because they access account resources or create provider webhooks. Resend API keys may likewise be restricted to sending access or granted full access. Automate.ax represents a send-only key as emails:send, so the same action requirements apply to both connection methods. SMTP credentials aren’t supported because they cover only sending and can’t satisfy the wider automation surface. Automate.ax resolves the OAuth token or API key only inside account-backed actions and never places it in action inputs or outputs.

Call an uncovered endpoint

Use getResendApi inside a custom Resend-account-backed action when a public provider endpoint doesn’t have a packaged action. Supply a Zod schema for every successful response:

automations/list-resend-domains-raw.automation.ts

import {
  automation,
  defineAction,
  markSignificant,
  onDashboardRun,
} from "automate.ax"
import { getResendApi } from "automate.ax/resend"
import { z } from "zod"

const listDomainsRaw = defineAction("List Resend domains with raw API")
  .account("resend", "full_access")
  .input(z.object({ limit: z.number().int().min(1).max(100) }))
  .output(z.object({ id: z.string(), name: z.string() }).array())
  .handler(async ({ account, input }) => {
    const response = await getResendApi(account).call("domains", {
      query: { limit: input.limit },
      responseSchema: z.object({
        data: z.object({ id: z.string(), name: z.string() }).array(),
        has_more: z.boolean(),
        object: z.literal("list"),
      }),
    })
    return response.data
  })

export default automation("Inspect Resend domains", () => {
  onDashboardRun({ title: "Inspect Resend domains" })
  const domains = listDomainsRaw({ limit: 50 })
  markSignificant(domains)
})

Paths are relative to https://api.resend.com/; the helper rejects another origin and adds Authorization, Accept, and User-Agent headers. Query arrays become repeated parameters. Plain request bodies are encoded as JSON; pass FormData for multipart requests without setting its Content-Type boundary yourself. Successful responses are validated with responseSchema, including empty responses when the schema is z.undefined(). Failures throw ResendApiError with the path, HTTP status, provider error name and status code when present, Retry-After, rate-limit values, and available daily or monthly quota metadata. Don’t use the raw helper to update or delete an Automate.ax-managed webhook. Managed triggers persist the webhook ID and one-time signing secret, so changing that webhook outside the trigger lifecycle can stop delivery or make otherwise valid callbacks fail signature verification.

Know what remains unsupported

The packaged surface excludes provider credential administration (API-key CRUD and OAuth grant revocation), public webhook CRUD, Resend-native automation graphs, deprecated Audiences and audience_id workflows, private-beta metrics or inspection endpoints, and generic segment-filter operations. Use the raw helper for a current public endpoint only when it doesn’t mutate an Automate.ax-managed webhook or another platform-owned resource. SMTP is intentionally unsupported.

Receive verified Resend events

Triggers create and remove account webhooks automatically. Automate.ax verifies the exact raw request body with Resend’s webhook signing secret and the svix-id, svix-timestamp, and svix-signature headers. Requests outside the five-minute timestamp tolerance or with an invalid signature are rejected before event classification. Resend webhooks are at-least-once and aren’t guaranteed to arrive in order. Automate.ax uses the svix-id as delivery evidence so provider retries don’t create duplicate events for the same subscription. A valid callback is acknowledged with an exact 200 response; the webhook delivery remains an ordinary root context and is joined to related automation work through correlation when applicable.

Built-in triggers

Built-in actions

Runtime utilities

Integrations

Connect Resend and receive verified events

Choose Resend access

Call an uncovered endpoint

Know what remains unsupported

Receive verified Resend events

Confirm Resend behavior

​Choose Resend access

​Call an uncovered endpoint

​Know what remains unsupported

​Receive verified Resend events

​Confirm Resend behavior

Choose Resend access

Call an uncovered endpoint

Know what remains unsupported

Receive verified Resend events

Confirm Resend behavior