Credentials and account configuration

Acquire secrets in your application and supply the exact credentials and attestations required by each provider.

Use your existing provider account. Corven does not issue a platform API key, host an email account or authenticate against the documentation site.

Acquire secrets in the host

Your application reads environment variables, a secret manager or another approved credential source and supplies Redacted values to provider Layers. The SDK does not discover .env files, cloud identity endpoints or account configuration.

Redacted reduces accidental disclosure; it does not make a secret safe to put in logs, telemetry, browser bundles or model input. Keep the value wrapped until the trusted request builder needs it.

Match the provider’s option names

Credential options differ: Resend uses apiKey, Postmark and MailPace use serverToken, Lettermint uses apiToken, and Cloudflare needs both apiToken and accountId. SES needs explicit signing credentials; Graph needs an access token acquired and refreshed by your host. SMTP has an explicit authentication union.

Select your provider guide for a complete configured Layer example. A token accepted by configuration validation can still lack remote sending permission.

Review account attestations

Some Layers require literal settings such as tracking: "DomainDisabled" or contactWrites: "AllowUpsert". These record what behavior your application permits or what remote settings it has checked. They do not cause the SDK to inspect, disable or enable anything remotely.

Review these choices before copying an example into production. In particular, profile writes, rendering, retention and automatic copies can change the privacy or content contract.

Verify without sending

Use local preflight to check message support without credentials. The CLI is also offline. Neither authenticates an account. Live authentication and sending require separate operational controls; see verification boundaries.