Skip to main content

Email Provider for Casdoor Verification Codes: Brevo SMTP, Resend, SendGrid, ACS Email and SES

· 10 min read
Yang Luo
Yang Luo
Casdoor Maintainer

Casdoor sends sign-up verification codes, password reset links and magic links through an Email provider. It has native API types for Resend, SendGrid and Azure Communication Services (ACS) Email, a Default SMTP type that works with any SMTP relay (your own server, Google Workspace, Microsoft 365, Brevo, Amazon SES), and a Custom HTTP Email type for any other HTTP API. If you want a free tier and a short setup, start with Resend or Brevo. If you already run on AWS or Azure, SES or ACS keeps billing in one place. Whichever you pick, the deliverability work is the same: a sender domain with SPF and DKIM that align with the From address.

The options at a glance​

Free tiers and prices were checked on 2026-11-02 on each vendor's own pricing page.

ProviderAPI or SMTPFree tier (checked 2026-11-02)Sender domain setupCasdoor type
Your own mail serverSMTPYou run itYou publish SPF, DKIM and DMARC, and need forward and reverse DNS for the IPDefault
Google Workspace (smtp.gmail.com)SMTP with an app passwordPart of the Workspace subscription, 2,000 messages per dayYour Workspace domainDefault
Microsoft 365 (smtp.office365.com)SMTP AUTHPart of the subscriptionYour Microsoft 365 domainDefault
BrevoSMTP relay (smtp-relay.brevo.com)300 emails per dayBrevo code (TXT), DKIM and DMARC recordsDefault
ResendAPI3,000 emails per month, 100 per daySPF and DKIM records generated by Resend, then DMARCResend
SendGridAPI60-day trial, 100 emails per dayDomain authentication: CNAME records for SPF and DKIM, TXT for DMARCSendGrid
Azure Communication Services EmailAPINone listed; $0.00025 per email plus $0.00012 per MBAzure managed subdomain, or a custom domain with SPF and DKIMAzure ACS
Amazon SESSMTP interfaceNo SES-only quota; new AWS accounts get Free Tier credits that SES can useVerified identity for every From addressDefault
Any other HTTP APIHTTPDepends on the serviceDepends on the serviceCustom HTTP Email

The Email providers overview in the docs lists the same types and the fields each one uses.

SMTP: your own server, Google Workspace, Microsoft 365​

The Default type takes a host, port, username and password. SSL mode Auto uses implicit TLS on port 465 and STARTTLS on other ports, which covers almost every relay below.

With your own server, SPF, DKIM signing, reverse DNS and IP reputation are all yours. Google requires valid forward and reverse DNS (PTR) records for the sending IP.

Google Workspace documents smtp.gmail.com on port 465 or 587, signed in with the full Workspace address and an app password, with a limit of 2,000 messages per day.

Microsoft 365 is the one to avoid for new setups. Casdoor's SMTP provider signs in with a username and password, which is Basic authentication for SMTP AUTH. Microsoft has announced plans to retire Basic authentication for SMTP AUTH in Exchange Online, and has already turned SMTP AUTH off in tenants that weren't using it. Check the latest timeline in the announcement below before you build on it.

Brevo SMTP​

Brevo sends transactional mail through a standard SMTP relay, so it uses the Default type. Most setup problems come from the Brevo SMTP login:

  • The server is smtp-relay.brevo.com, on port 587, 465 or 2525. Port 465 needs SSL, which Auto handles.
  • The SMTP login is not always your account email. Depending on when the account was created, it is either your login email or a generated address like [ID]@smtp-brevo.com, and it is shown on the SMTP page in Brevo. Changing your account email doesn't change it.
  • The password is an SMTP key, not an API key.

In Casdoor, set Type to Default and put those values in Host, Port, Username and Password. The Brevo guide has screenshots. For the domain, Brevo asks for its own TXT verification record, DKIM and DMARC; SPF is only needed with a dedicated IP.

Resend​

The Resend type needs only an API key in Secret key, plus a From address on a verified domain. Leave Host, Port and Username empty. Casdoor formats the sender as Name <address> from From name, or from the organization's display name when From name is empty.

Two things to know before you test. First, the shared onboarding@resend.dev sender can only send to the email address of your own Resend account; any other recipient gets a 403. Second, verifying your own domain means adding the SPF and DKIM records Resend generates, and Resend recommends sending from a subdomain to keep its reputation separate. The free plan covers 3,000 emails a month with a cap of 100 per day; the Pro plan starts at $20 a month for 50,000. See the Resend guide.

SendGrid​

The SendGrid type uses an API key. Leave Host and Endpoint empty and Casdoor uses SendGrid's standard send API; fill both only if you need a different endpoint. Casdoor treats anything but 202 Accepted as a failure and shows the error messages SendGrid returns, which helps when a sender isn't verified yet.

SendGrid's pricing page lists a 60-day free trial at 100 emails a day, then Essentials from $19.95 a month. Domain authentication with automated security adds a CNAME for SPF and DKIM and a TXT record for DMARC. See the SendGrid guide.

ACS Email (Azure Communication Services)​

The Azure ACS type takes the resource endpoint as Host and the access key as Secret key; Casdoor signs each request with that key. Azure gives you a one-click managed subdomain under azurecomm.net with authentication already set up, and Microsoft suggests using it for development and switching to a custom domain, with its SPF and DKIM records, for launch. There is no free tier on the pricing page: $0.00025 per email plus $0.00012 per MB transferred. See the Azure ACS guide.

Amazon SES​

Casdoor has no SES API type, so use the SES SMTP interface with the Default type. The host is the Region's SMTP endpoint, such as email-smtp.us-east-1.amazonaws.com; SES accepts STARTTLS on 25, 587 or 2587 and implicit TLS on 465 or 2465. The SMTP username and password are SMTP credentials you generate in SES. They are not your AWS access keys, and they are different in each Region.

New accounts start in the SES sandbox: mail goes only to verified addresses, at most 200 messages per 24 hours and one per second. Request production access before real users sign up. SES charges $0.10 per 1,000 outbound emails at its à la carte rate, with no minimum fee.

Custom HTTP Email​

For a service without a native type, Custom HTTP Email sends fromAddress, fromName, toAddress (or toAddresses for several recipients), subject and content as a form or JSON body, with headers you define. You can rename each field to match the target API. Casdoor counts only HTTP 200 as success, so an API that answers 202 Accepted shows up as an error; a small adapter in front fixes that. See Send email through your own HTTP API.

Deliverability basics for auth mail​

Verification codes are useless if they land in spam. The rules that matter:

  • SPF and DKIM. Google requires every sender to Gmail to use SPF or DKIM. Above 5,000 messages a day it requires both, plus DMARC (a p=none policy is accepted). Set up all three from the start.
  • Alignment. The domain in the From header must match the SPF domain or the DKIM domain, or DMARC fails. This is why each provider makes you verify the domain you send from.
  • A separate subdomain. Yahoo recommends separating transactional mail from marketing mail by IP or DKIM domain, and Resend recommends subdomains. Something like auth.example.com keeps a bad newsletter from hurting your password resets.
  • TLS and spam rate. Google requires TLS and asks you to keep the reported spam rate below 0.3%, ideally below 0.1%.
  • No unsubscribe header needed. Google's FAQ says one-click unsubscribe applies to marketing mail, and names password reset messages as an example of transactional mail that is excluded.
  • Simple content. Casdoor sends the template as one HTML body, without a separate plain-text part, for every built-in type. Keep the HTML light, put the code in plain text, and show the full link as text next to the button, as Casdoor's built-in magic link email does. Use your Casdoor origin directly rather than a link shortener, so the link domain matches your brand.

Configure and test the provider in Casdoor​

  1. Go to Identity > Providers, add a provider, set Category to Email and choose the Type from the table above.
  2. Set From address and, optionally, From name.
  3. Write Email title and Email content. The content can use %s for the code, %{user.friendlyName} for the user's name, and %link inside a <reset-link> block for the password reset link. Magic link emails use %link and %expireTime; if your content has no %link, Casdoor sends its own magic link email instead. The templates section has examples. Codes and magic links expire after verificationCodeTimeout in conf/app.conf, which defaults to 10 minutes and matches the default template text; if you change the timeout, change the wording in your template too.
  4. Click Test SMTP Connection to open a connection without sending (SMTP types only), then enter an address in Test Email and click Send Testing Email. The test uses the values in the form, saved or not, with %s replaced by 123456 and the reset link block removed.
  5. Add the provider to the application with a rule such as Signup, Forget Password, Magic link or All. You can use different providers for different rules. See Add providers to an application.
  6. Set origin in conf/app.conf. Without it, unless the request comes in on a loopback host such as localhost, Casdoor leaves the reset link out of password reset emails and refuses to send magic links. See Sign in with a magic link.

For local development, point a Default provider at a fake SMTP server instead of a real account; MailHog vs Mailpit covers that setup.

References​