KeyKeeperResend
How an agent gets a Resend key through KeyKeeper, what to choose on resend.com, and how KeyKeeper verifies it.
| Template id | resend (also resend-api-key) |
|---|---|
| Field | resend-api-key → RESEND_API_KEY · secret |
| Key looks like | starts with re_, shown once when created |
| Created at | resend.com |
| Verified by KeyKeeper | GET https://api.resend.com/domains — lists domains; a sending-only key answers 'restricted', which also proves it is real |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show resend
keykeeper save --provider resend --from-clipboard --create --purpose "what this task does"
keykeeper run -c resend -- <your command>--provider resend fills in the credential id and the field. The environment
variable is the one Resend's own tools read, so nothing has to be mapped.
What only you can do
Log in to resend.com
Name the key
Pick the permission and, for sending access, the domain
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Permission = Sending access, limited to the one domain the task sends from. Full access can manage domains and other keys; do not suggest it.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Resend key (starts with
re_, shown once when created). A wrong paste is refused before anything is stored, and the agent is told why — without the value. - After saving: KeyKeeper itself sends
GET https://api.resend.com/domainswith the key in theAuthorizationheader (lists domains; a sending-only key answers 'restricted', which also proves it is real). A restricted key that answers withrestricted_api_keycounts as valid. The agent receives accepted, rejected or could not reach — never the value.
Rotation and expiry
Keys do not expire; Resend suggests removing keys unused for 30 days. Rotate or revoke at resend.com.