Send authentication emails

When cloud() is configured, Own Auth sends magic links, verification emails, password resets, and organisation invites through the app's Cloud API key. No separate email provider is required.

import { createOwnAuth } from "own-auth";
import { cloud } from "own-auth/cloud";

export const auth = createOwnAuth({
  tokenPepper: process.env.OWN_AUTH_TOKEN_PEPPER,
  plugins: [cloud({ key: process.env.OWN_AUTH_CLOUD_KEY! })]
});

The app's Daily send limit applies across all of its keys and both email endpoints. It counts new email reservations per UTC day and resets at midnight UTC. An exhausted daily limit returns HTTP 429 with quota_exhausted, including on paid plans with overages enabled. Retries of an accepted delivery do not consume another slot. Queue failures and cancelled email that has not started sending return the reserved slot to its original day. SMS does not use the daily email allowance.

Cloud accepts only authentication email types. It validates recipients, configured URL destinations, idempotency keys, app quotas, and recipient limits. Tokens, URLs, message bodies, provider diagnostics, and raw keys never enter telemetry or delivery logs.

An explicit emailProvider takes precedence over Cloud delivery. Cloud remains connected for dashboard, analytics, audit, and security features while the application sends its own email.