Password reset emails, sent from your own domain

Trigger the reset email from your backend with one API call. Sendix signs it with your domain’s DKIM key, queues it as critical mail and reports delivery, bounces and failures back to your app.

Start sending free Read quickstart

DKIM-signed from your domain
Idempotency-Key safe retries
Critical priority lane
Per-message delivery events

email api request

ready

send-reset.tsPOST /v1/emails

const res = await fetch("https://sendix.dev/api/v1/emails", {
  method: "POST",
  headers: {
    Authorization: "Bearer " + process.env.SENDIX_API_KEY,
    "Content-Type": "application/json",
    "Idempotency-Key": "reset-" + token.id,
  },
  body: JSON.stringify({
    from: "Acme Security <[email protected]>",
    to: [user.email],
    subject: "Reset your Acme password",
    template_id: RESET_TEMPLATE_ID,
    template_data: { name: user.firstName, reset_url: resetUrl },
    priority: "critical",
    tags: [{ name: "flow", value: "password-reset" }],
  }),
});
const { id } = await res.json(); // 202 Accepted

POST /v1/emailscriticalIdempotency-Key

Short answer

How do I send password reset emails with Sendix?

Generate a single-use, short-lived token in your app, build the reset URL, and POST it to https://sendix.dev/api/v1/emails from a verified domain with priority "critical" and an Idempotency-Key derived from the token. Sendix returns 202 with the email id, signs the message with your DKIM key, and emits email.delivered, email.bounced or email.failed webhooks so support can see exactly what happened to each reset.

How it works

Four steps from app event to delivered email.

What your code does, what Sendix does, and where to look when something goes wrong.

01
your app
Create the token
Generate a random, single-use token in your app, store only its hash, and give it a short expiry such as 30 minutes.
02
template_data
Render the message
Reference a Sendix template with {{name}} and {{reset_url}} variables, or send your own html and text bodies.
03
Idempotency-Key
Send with a stable key
POST /v1/emails with an Idempotency-Key based on the token id. A retried request returns the same email id instead of sending twice.
04
webhooks
Watch the outcome
Subscribe to delivery webhooks, or read GET /v1/emails/{id}/events when a user says the email never arrived.

Best practices

Details that keep this mail reliable.

Habits that protect deliverability and your users, whichever provider you use.

Send from a domain you verified

Use an address such as security@ on a domain verified in Sendix, with SPF, DKIM, DMARC and the bounce CNAME published.

Always include a text part

Some clients and security scanners read plain text first. Send text alongside html, or keep both in the template.

Keep links short-lived and single-use

Expire the token after use or after a short window, and invalidate older tokens when a new reset is requested.

Don’t reveal whether an account exists

Show the same confirmation for known and unknown addresses; only send the email when the account really exists.

Rate-limit the reset form

Throttle requests per account and per IP in your app so the form cannot be used to flood someone’s inbox.

Respect suppressions

Addresses that hard-bounced or complained are suppressed; Sendix reports email.suppressed instead of sending to them.

Webhook events

The events worth subscribing to.

Sendix signs each webhook with X-Sendix-Signature and keeps the same events on the message at GET /v1/emails/{id}/events.

Event	What to do with it
email.sent	What to do with itHanded to the delivery pipeline.
email.delivered	What to do with itAccepted by the recipient’s mail server.
email.delivery_delayed	What to do with itTemporary failure; Sendix keeps retrying.
email.bounced	What to do with itPermanent failure — ask the user to check the address.
email.suppressed	What to do with itAddress is on the suppression list; nothing was sent.

FAQ

Frequently asked questions

Short answers to the questions teams ask while wiring this up.

Should password reset emails use the API or SMTP?

Either works. The API gives you idempotency keys, tags, priority and template variables in one request. SMTP (smtp.sendix.dev on port 587 with STARTTLS, your Sendix API key as the password) fits frameworks that already send reset mail through a mailer.

How do I stop duplicate reset emails when my job retries?

Send an Idempotency-Key header (8–128 characters) derived from the reset token id. Repeating the request with the same key returns the original email id with "idempotent": true instead of sending a second message.

Can support see whether a specific reset email was delivered?

Yes. Every send returns an email id. GET /v1/emails/{id}/events lists its events and delivery attempts, and webhooks push the same events to your endpoint as they happen.

What happens if the address bounced before?

Hard bounces and complaints add the address to your suppression list, and later sends are reported as email.suppressed rather than attempted. Remove the entry with DELETE /v1/suppressions/{email} once the user fixes their address.

Keep reading