Mail

Declare mail: { enabled: true } in backify.config.ts and use server-side mail.send from @backifydev/sdk/app. The workload broker enforces sender, permissions and limits; never put provider credentials in application code.

import { mail } from "@backifydev/sdk/app";
await mail.send({ to: "recipient@example.com", subject: "Receipt", text: "Your order is confirmed.", idempotencyKey: "receipt-order-123", sensitive: true });

to accepts one address or an array. Optional fields are cc, bcc, html, attachments, idempotencyKey and sensitive. A result contains id, status (sent/sending/failed), from and optional error; provider acceptance is not proof of mailbox delivery.

Enforced limits

  • 25 attempts per application per UTC month, shared by environments.
  • 50 total To/CC/BCC recipients, 10 attachments totaling 10 MiB decoded.
  • 256 KiB combined text/HTML; 998-character subject without control characters.
  • Attachment filenames at most 255 characters, without paths/control characters. content is canonical padded base64, not a data URL; contentType is optional.
  • Idempotency keys at most 128 characters. Without a key, identical sends deduplicate for a rolling five minutes.

Managed sends use the application's configured Backify sender; callers cannot select arbitrary sender domains or headers. sensitive: true prevents storing original subject/body in Backify history; it does not alter the delivered message or provider/mailbox retention. Never log attachments or credentials.

backify dev captures mail as files in .backify/dev/mail, without real delivery. Verify real delivery in preview. See jobs for retry-safe background sends and the runtime contract.