AWS SES

Select SES#

VITE_MAIL_PROVIDER=ses

Configure credentials#

AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...
SES_REGION=us-east-1
MAIL_FROM_EMAIL=TanStarter SES <noreply@app.example.com>
SUPPORT_EMAIL=owner@example.com

Optional temporary credentials:

AWS_SESSION_TOKEN=...

SES_REGION takes precedence over AWS_REGION; the adapter otherwise defaults to us-east-1.

Verify a sender identity#

AWS SES requires a verified email address or domain in the selected region. Prefer a verified domain and set MAIL_FROM_EMAIL at runtime so production identities never need to be committed. SUPPORT_EMAIL controls the recipient for the contact workflow.

SES verification is regional. A domain verified in one region is not automatically available in another.

Sandbox constraints#

New SES accounts may be in the sandbox. Sandbox mode can restrict recipients to verified identities and impose lower sending limits. Request production access in the AWS region you plan to use.

Worker implementation#

The adapter calls the SES v2 SendEmail endpoint and signs the request with SigV4 through aws4fetch:

https://email.us-east-1.amazonaws.com/v2/email/outbound-emails

This avoids bundling the full AWS SDK into the Worker.

Required IAM permission#

Grant the smallest permission that supports delivery, typically ses:SendEmail, scoped to the verified identity when possible.

Production verification#

1. Confirm the sender identity in the selected region.
2. Add AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, SES_REGION, MAIL_FROM_EMAIL, and SUPPORT_EMAIL as Wrangler secrets.
3. Disable MAIL_PREVIEW.
4. Register a disposable user and receive the verification email.
5. Exercise password recovery and the contact route.
6. Inspect SES events, bounces, and complaint handling in AWS.