email

Set up SMTP for each website and send emails with mail.send.

SMTP settings

In host, enter only the SMTP host without a protocol such as https://.
Typically uses port 587 and secure false, switching to STARTTLS if the server supports it.
SMTPS that uses TLS from the connection usually uses port 465 and secure true.
from is the website default sender that applies to all mail.send calls.
Changes to settings will take effect after restarting the website.

// package.json
{
  "mail": {
    "host": "smtp.example.com",
    "port": 587,
    "secure": false,
    "from": "Cake20 <[email protected]>"
  }
}

SMTP authentication information

Save SMTP_USER and SMTP_PASSWORD in Secret in website settings.
You cannot set only one of the two values; omit both if SMTP does not require authentication.
Authentication information is not written directly in package.json or the server source.
Secrets are stored encrypted and only transmitted to the website execution environment.

send email

Requires to, subject and either text or html.
to, cc, bcc and replyTo can use strings, address objects or arrays.
The transmission result includes messageId, accepted, rejected, and SMTP response.
Editor test runs of APIs, jobs and tasks also send emails via actual SMTP.

// server/api/welcome.post.ts
export const config = {
  filter: { email: z.string().email() },
  sample: { email: "[email protected]" }
};

export default async (
  data: Input<typeof config.filter>,
  context: ApiContext
) => {
  await auth.require(context.request);
  return mail.send({
    to: data.email,
    subject: "Welcome to join.",
    text: "Your registration has been completed.",
    html: "<strong>Your registration has been completed</strong>"
  });
};

attachment

Pass a string or Uint8Array to the attached content.
Blocks the ability to directly read website file paths or external URLs as attachments.
For bulk sending, do not repeat it within the API request, but record the target in the DB and process it by dividing it into tasks.
Public APIs enforce authentication, recipient restrictions, and request restrictions to prevent open relays.

const content = await storage.get("reports/monthly.pdf");
if (!content) throw new Error("There are no attached files.");

await mail.send({
  to: "[email protected]",
  subject: "monthly report",
  text: "Attached is the report.",
  attachments: [{
    filename: "monthly.pdf",
    content,
    contentType: "application/pdf"
  }]
});