← Back to guides

Authentication email delivery with Own Auth

Own Auth creates the URL for each magic link, email verification, password reset, and organisation invitation. This guide uses Own Auth Cloud for authenticated requests, rate limits, queued sending, retries, and delivery events.

Connect Own Auth Cloud

Own Auth still creates, stores, and verifies each one-time token. baseUrl puts the application's public origin in every emailed auth URL. The Cloud plugin sends the finished URL and message details through the app's Cloud API key.

auth.ts
import { createOwnAuth } from "own-auth";
import { cloud } from "own-auth/cloud";

const baseUrl = process.env.APP_URL!;
const tokenPepper = process.env.OWN_AUTH_TOKEN_PEPPER!;

export const auth = createOwnAuth({
  tokenPepper,
  baseUrl,
  plugins: [cloud({ key: process.env.OWN_AUTH_CLOUD_KEY! })],
});

Authenticate, limit, and queue each send

Cloud authenticates the app key, validates the email type, recipient, and auth URL, then applies key, recipient, and application limits. A successful request is queued and recorded as accepted.

Report the delivery state

  • Accepted: Cloud validated the request and queued the message.
  • Delivered: the recipient server accepted the message.
  • Failed: the message hit a permanent failure or exhausted its retries.

Cloud retries temporary sender failures up to three times. Permanent failures fail immediately. Suppressed recipients are rejected before the message enters the queue.