Skip to main content
Email servers are first-class organization resources (ems_…) used by action.email. Cloud Studio and on-prem deployments use the same Settings, API, CLI, and SDK surfaces. There is no default server and no deployment-file fallback: each Send Email step must select a live server. This is not the platform Resend configuration used for Studio invitations and inbound agent mail. Workflow outbound servers do not send those messages, and platform mail is not a fallback for action.email. Secrets (Resend API keys, SMTP passwords, and optional SMTP CA PEMs) are encrypted at rest. List and get responses never return them; they expose configuration flags such as apiKeyConfigured, passwordConfigured, and caPemConfigured instead. Owners and admins can create, update, test, and delete servers. Other members can list and inspect the redacted view.

​
Studio

  1. Open Settings → Email servers.
  2. Add a server. Choose Resend (API key plus From name and address) or SMTP (host, security, port, optional username/password, optional CA PEM).
  3. Send a test message to confirm delivery.
  4. In a workflow, add Send Email and pick the server. The step stores the stable ems_… id.
You can keep several servers (for example a production SMTP relay and a Resend account for a second From address). Disabling a server leaves it listed but blocks sends and publish until you enable it or select another server. Deleting a server is a soft delete: the id stops resolving, and steps that still reference it fail until you change with.server. For SMTP, paste a custom CA as PEM on the server when you need one. There is no filesystem CA path. When you change an SMTP host or username, send a new password or clear authentication (username: null). The previous password is never reused against a new destination. Metadata-only updates and same-host, same-username edits may omit the password to keep the stored value. SMTP security defaults to STARTTLS. If you omit the port, Eigenpal uses 587 for STARTTLS, 465 for TLS, and 25 for none. Use none only for trusted internal relays; username and password are not allowed with that mode.

​
API, CLI, and SDKs

The public contract is /v1/email-servers: Request and response schemas, including the paginated list envelope, live in the API reference. Do not put secrets in query strings or CLI flags. The CLI matches that surface:
See eigenpal email-servers for every subcommand and flag. Provide Resend API keys, SMTP passwords, and CA PEMs with --*-stdin, --*-file, or the secure prompt. TypeScript (@eigenpal/sdk) and Python (eigenpal) wrap the same operations:
See the TypeScript and Python references for every method, and the API reference for HTTP shapes they wrap. A test send delivers a real connectivity message through the stored server. Disabled servers reject the test. Workflow evaluation runs still skip action.email delivery, including invoked child workflows.