# Provider credentials (/docs/getting-started/credentials)



Credentials belong in the server process that constructs the adapter. Email SDK does not read a universal configuration file or expose credentials to browser code.

## Required environment variables [#required-environment-variables]

Run the adapter catalog to see the names required by the bundled CLI.

```bash
npx email-sdk adapters
```

Common adapters use these values:

| Adapter    | Required environment variables                             |
| ---------- | ---------------------------------------------------------- |
| Resend     | `RESEND_API_KEY`                                           |
| Postmark   | `POSTMARK_SERVER_TOKEN`                                    |
| SendGrid   | `SENDGRID_API_KEY`                                         |
| AWS SES    | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION` |
| Mailgun    | `MAILGUN_API_KEY`, `MAILGUN_DOMAIN`                        |
| Cloudflare | `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`            |
| SMTP       | `SMTP_HOST`; auth also uses `SMTP_USER` and `SMTP_PASS`    |

The [adapter pages](/docs/adapters) list every credential and adapter-specific option.

## Pass credentials to application code [#pass-credentials-to-application-code]

Adapter factories accept credentials explicitly. Environment variable names are a deployment convention rather than a hidden SDK lookup.

```ts title="src/email.ts"
import { resend } from "@opencoredev/email-sdk/resend";

export const resendAdapter = resend({
  apiKey: process.env.RESEND_API_KEY!,
});
```

## Check configuration [#check-configuration]

`doctor` checks whether the CLI has enough values to construct the adapter. It does not prove that a credential is accepted by the provider.

```bash
RESEND_API_KEY=re_xxx npx email-sdk doctor --adapter resend
```

Use `send --dry-run` to validate a full message without network delivery. Use a real send only with an approved test recipient.

## SMTP transport security [#smtp-transport-security]

SMTP auth on a non-secure port requires TLS. The transport upgrades with STARTTLS by default. Set `allowInsecureAuth` only for a trusted local test server.

<Card title="Browse adapters" href="/docs/adapters" description="Open the setup page for the provider you use." />

<Card title="CLI doctor" href="/docs/reference/cli/doctor" description="See exact configuration checks and failure modes." />