Laravel Cloud Apps Can Now Add Resend Without Copying an API Key

Resend now appears as a resource on the Laravel Cloud canvas, the company said in an Oct. 15 changelog entry. An app can start sending without anyone creating an API key by hand. Resend said the integration removes the old routine of creating a key, pasting it into the environment and configuring a sender.

One sign-in covers every application

The integration is account-wide, according to Resend. A team authorizes Resend once. Resend can then be attached to any number of Laravel Cloud applications. Keys are provisioned for each environment.

Resend described the setup. Open the application’s canvas in Laravel Cloud, click Add resource, choose email, then sign in to Resend over OAuth and approve access. The team then picks a sending domain and sets the sender name and address.

Full access lets Laravel Cloud change the sending domain

Resend said approving full access lets a team change its sending domain and sender details from inside Laravel Cloud. The company said permissions can be viewed or revoked at any time from the Team settings page in a Resend account.

Laravel Cloud prompts for the PHP Resend package in the project’s dependencies when it is missing, Resend said. The app sends through Resend on the next deploy. Resend pointed Laravel developers to its resend/resend-laravel package and said non-Laravel code can use SMTP.

The Laravel Cloud API can attach it too

Resend’s entry shows a POST request to /api/environments/{environment}/resend on the Laravel Cloud API, authorized with a bearer token. A team that builds environments from scripts can attach Resend the same way, without opening the canvas.

Key takeaways

• Resend is now an email resource on the Laravel Cloud canvas.
• One OAuth sign-in covers all of a team’s applications.
• Keys are provisioned per environment, and the Laravel Cloud API can attach Resend from a script.

The take

We think the point is where the secret lives. A key pasted into an environment by hand is a secret a person handled. Those tend to end up in chat, in a notes file or in a laptop’s shell history. A key that a platform provisions and ties to one environment never passes through anyone’s hands.

The permission model matters too. Full access is convenient, but it lets another service change sending domains. Pick it only if Laravel Cloud is where you want that work done.

Teams already on Laravel Cloud should open the Team settings page in Resend after connecting and confirm which permissions they granted. They should delete any old hand-made keys once the new environment sends.