Magic-link authentication
Offer passwordless email login without requiring users to create or remember passwords.
Auth.js · Const
Resend
Resend is an Auth.js passwordless email provider that sends magic links with verification tokens. It requires a database adapter, a verified sending domain, and a Resend API key.
How it works
Resend is Auth.js’s passwordless email provider. It sends a verification link containing a token; the token is stored through a database adapter and, when followed before expiry, signs the user in or creates the account.
Syntax
Resend(options)Parameters
| Name | Type | Description |
|---|---|---|
options | ResendConfig | Optional provider settings, including the sending address and API key; the documented example configures from. |
Returns
A configured Resend email provider for the Auth.js providers array.
Key points
- Resend provides passwordless sign-in by sending users magic links containing verification tokens.
- A verification token normally expires after 24 hours.
- Following a valid link can create the user account and immediately establish the sign-in.
- Resend can be offered alongside OAuth providers or used as the sole authentication option.
- The Resend API key is conventionally supplied through AUTH_RESEND_KEY.
- Using the conventional variable name lets the provider discover the API key without extra configuration.
Common mistakes
- A database adapter is still mandatory even when sessions use JSON Web Tokens, because email verification tokens need persistence.
- Verify the sending domain in Resend and use an address from that domain in
from. - Renaming AUTH_RESEND_KEY requires explicitly supplying the alternative environment variable value to the provider.
Example: Configure Resend with NextAuth
import NextAuth from "next-auth"
import Resend from "next-auth/providers/resend"
export const { handlers, auth, signIn, signOut } = NextAuth({
providers: [
Resend({
from: "no-reply@company.com",
}),
],
})Register Resend as an email provider; the provider reads AUTH_RESEND_KEY automatically and sends sign-in links from the configured address.
When to use it
Hybrid authentication
Provide email login together with Google, GitHub, or other OAuth providers.
Transactional verification email
Use Resend’s email delivery service for Auth.js verification messages.
Interview questions
QHow does Resend authenticate a user?
Resend implements passwordless authentication by emailing a verification token inside a sign-in URL. A valid link signs in an existing account or creates a new account for the email address.
Follow-up: Why is a database required? The verification token must be stored, so email authentication cannot be enabled without a database adapter.
QHow long is the verification token valid by default?
The default token lifetime is 24 hours. The user must follow the emailed link during that period for the token to be accepted.
Follow-up: How would you change the lifetime? Configure the email provider’s maxAge according to the broader Auth.js email-provider configuration.
QWhat setup is required before enabling Resend?
Configure a database adapter, add a verified Resend domain, generate an API key, and expose it as AUTH_RESEND_KEY. Then register Resend in the providers array and configure a suitable from address.
Follow-up: What happens if the environment variable is renamed? Pass the renamed value explicitly in the Resend provider configuration.
Related
Email ProviderVerification Tokendatabase adapterAUTH_RESEND_KEYfromNextAuth