Authentication
The Resend API declares one security scheme. The client sends each credential only on the operations whose security requirement accepts that scheme, so one configured client covers every operation.
| Scheme | ClientAuth field | Sent as |
|---|---|---|
| bearerAuth | bearerAuth | Authorization: Bearer … |
Configuring the client
Credentials go on the client once, when it is created, and the SDK attaches the right one to each request.
ts
const client = new Resend({
// Optional: replaces the default server and any server an operation declares.
baseUrl: "https://api.resend.com",
auth: { bearerAuth: process.env.API_TOKEN! },
});Keep credentials out of source control
Read them from the environment or a secrets manager, as the quickstart does. A key committed to a repository should be treated as leaked and rotated.