Resend
MESSAGING · EMAIL
Send email and manage domains, audiences, and broadcasts on their own key.
Connecting Resend in practice
Resend rejects any request without a User-Agent header with a 403 and error code 1010, which looks exactly like an invalid API key and is not one. The rate limit is 10 requests a second for the whole team rather than per key, and on the free plan a separate daily email quota resets at midnight UTC rather than on a rolling 24-hour window.
Scopes that draw scrutiny
Full access API keyResend’s own wording: create, delete, get and update any resource — including creating further API keys and deleting verified domains.Sending access API keyThe narrow option, and it can be restricted further to a single verified domain. This is the key an agent that only sends mail should hold.
Rate limits
- 10 requests per second per team by default, shared across every API key on the team; raised for trusted senders on request.
- ratelimit-limit, ratelimit-remaining, ratelimit-reset and retry-after are returned per the sixth IETF rate-limit-headers draft.
- x-resend-monthly-quota reports used monthly sending quota, and x-resend-daily-quota is sent to free-plan users only.
- Quota overruns return 429 with a daily_quota_exceeded or monthly_quota_exceeded error type; both sent and received emails count.
- The batch endpoint sends up to 100 emails in one call.
Worth knowing
- Sending from the default resend.dev domain only works to the address on your own Resend account; any other recipient returns 403 with an explanatory message.
- Exceeding the marketing contact limit returns 403 with a validation_error when you send a broadcast, not 429 — so quota failures arrive under two different status codes.
- There is no API versioning at all today; Resend says calendar-based version headers are planned, so behaviour can change under a stable URL.
- An API key is viewable exactly once at creation, and its permission (full versus sending access) can be edited later in the dashboard without the key changing.
Checked against API introduction (2026-09-29), Usage limits (2026-09-29), Create an API key (2026-09-29), 403 error with error code 1010 (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Resend behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.