Auth emails

Your sign-in emails, your brand

Apps with user accounts send transactional emails — sign-in codes, magic links, password resets. Out of the box these use a clean platform default, but both the design and the sender address are yours to change: templates are edited on the Email Templates page (or in your project's code), and the sender domain is configured on the Domains page.

Customizing the email design

The quickest way is the Email Templates page in your project's navigation: pick an email, describe the design you want and generate it with AI (or edit the HTML directly), preview it live, and save. Saved templates apply to every deployed environment of the project within about a minute — no redeploy needed.

Templates can also live in your project's code, in a repobot.emails.json file at the root of your repository. Just ask your agent — "make the sign-in email match our brand colors" or "add our logo to the auth emails" — and it edits that file like any other code. Those templates version with your repository and apply automatically on the next deploy. A template saved on the Email Templates page takes precedence over the repo file for that email until you remove the customization.

You can customize three emails independently: the magic-link / sign-in code email, the sign-up confirmation email, and the password recovery email. Each has a subject line and an HTML body. Every template must include the sign-in code or confirmation link placeholder — a template without one would break sign-in, so an invalid save is rejected and an invalid repo file keeps the previous design (with the reason recorded in your audit log).

Sandbox previews never send real email, so template changes are safe to iterate on; they take effect on deployed environments only.

Sending from your own domain

By default, auth emails come from the platform's sender address. With an email sender domain (Starter plan and above), they come from your domain instead — auth@yourcompany.com. Setup happens on the Domains page:

• Add your domain and pick the deployed environment whose sign-in emails should use it.
• Publish the two DNS records shown — DKIM and SPF — at your domain registrar. These prove to receiving inboxes that Spaceboy may send on your behalf.
• Click Check status once the records are in. Verification usually completes within minutes of DNS propagating, and pending domains are re-checked automatically in the background.

Once verified, the environment's sign-in emails switch to your domain within about a minute — no redeploy needed. Removing the sender domain reverts to the platform address the same way.