Password-reset and magic-link emails.

A reset or magic link is ordinary transactional email. The secret stays in your database. The message only carries the URL you build. SendPanda does not issue the token, store the session, or decide when the link expires.

Use an idempotency key tied to the business event, such as reset plus the user id plus the token id. A timeout or a job retry then returns the original accept instead of mailing the person twice. The key is for that one event. A later reset needs its own key.

Send from a domain you have verified. The from address, SPF and DKIM are what receivers check. A queued status from the API means the message was accepted, not that the inbox delivered it. Delivery and bounces arrive as webhooks.

New accounts start at 100 emails a day. That is enough for a small app's resets. Limits rise as you send without bounces or complaints. Free is 1,000 emails a month.

Next.js server action. The SDK needs the Node.js runtime, not Edge.

// app/actions.ts
"use server";

import { SendPanda } from "@sendpanda/sdk";

const panda = new SendPanda(process.env.SENDPANDA_API_KEY!);

export async function sendPasswordReset(
  userId: string,
  resetId: string,
  to: string,
  url: string,
) {
  const email = await panda.emails.send(
    {
      from: "Your app <hello@your-verified-domain.com>",
      to: [to],
      subject: "Reset your password",
      html: `<p><a href="${url}">Reset your password</a></p>`,
      text: `Reset your password: ${url}`,
    },
    { idempotencyKey: `reset-${userId}-${resetId}` },
  );
  return { id: email.id, status: email.status };
}