Email

Parchment sends two types of email: verification codes for sign-in and invitations when an admin creates a new user. Email is entirely optional — if you skip this step, OTP codes are printed to the server console and invitations are silently skipped.

Any SMTP provider works. Set these variables in your .env:

SMTP_HOST=
SMTP_PORT=465
SMTP_SECURE=true
SMTP_USER=
SMTP_PASS=
SMTP_FROM=Parchment <noreply@yourdomain.com>

Provider examples

Resend

Create an account at resend.com
Add and verify your domain under Domains
Create an API key under API Keys

SMTP_HOST=smtp.resend.com
SMTP_PORT=465
SMTP_SECURE=true
SMTP_USER=resend
SMTP_PASS=re_your_api_key
SMTP_FROM=Parchment <noreply@yourdomain.com>

Postmark

Create an account at postmarkapp.com (requires a custom domain email to sign up)
Create a server and verify your sender domain
Find your SMTP credentials under Server → Credentials

SMTP_HOST=smtp.postmarkapp.com
SMTP_PORT=587
SMTP_SECURE=true
SMTP_USER=your_server_api_token
SMTP_PASS=your_server_api_token
SMTP_FROM=Parchment <noreply@yourdomain.com>

Amazon SES

Set up SES in the AWS console
Verify your domain and create SMTP credentials under SMTP Settings

SMTP_HOST=email-smtp.us-east-1.amazonaws.com
SMTP_PORT=465
SMTP_SECURE=true
SMTP_USER=your_ses_smtp_user
SMTP_PASS=your_ses_smtp_password
SMTP_FROM=Parchment <noreply@yourdomain.com>

Gmail

Enable 2-Step Verification on your Google account
Generate an app password

SMTP_HOST=smtp.gmail.com
SMTP_PORT=465
SMTP_SECURE=true
SMTP_USER=you@gmail.com
SMTP_PASS=your_app_password
SMTP_FROM=Parchment <you@gmail.com>

Self-hosted (Postal)

Postal is a free, open-source mail server you can run alongside Parchment.

SMTP_HOST=postal.yourdomain.com
SMTP_PORT=25
SMTP_SECURE=false
SMTP_USER=your_postal_credential
SMTP_PASS=your_postal_password
SMTP_FROM=Parchment <noreply@yourdomain.com>

Verifying

After setting your SMTP variables, restart the server. If the configuration is correct, sign-in emails and user invitations will be delivered. If something is wrong, check the server logs for SMTP errors.

Without email configured, the server logs a warning on each send attempt and prints OTP codes directly to the console — useful during development or if you only use passkey authentication.