Email / SMTP

Two different things called email

Account email — “verify your address”, “reset your password” — is a working feature, configured here.

The email alert channel — listing email in a watch’s channels — is not implemented. It logs the alert to the console instead of sending it. Use telegram or push for alerts.

Configuration

.env

SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=<username-or-api-key>
SMTP_PASSWORD=<password>
SMTP_FROM=Watcher <no-reply@example.com>
APP_URL=https://<your-panel-url>

Variable	Default	Notes
SMTP_HOST	—	Absent → the console fallback is used
SMTP_PORT	587
SMTP_SECURE	false, or true when the port is 465
SMTP_USER / SMTP_PASSWORD	—	Authentication is sent only when both are present
SMTP_FROM	falls back to SMTP_USER	The from address
APP_URL	falls back to the first WEB_ORIGIN	Base URL for links in the email

Without SMTP

Nothing breaks. The flows still work end to end — the verification and reset links are written to the server console instead of being emailed. That is enough for local development and for a single-user instance where you can read your own logs.

What gets sent

Email	Trigger	Link lifetime
Verify your email address	Registration, or a resend request	24 hours
Reset your password	A forgot-password request	1 hour, single use

APP_URL decides where those links point. Set it to your panel’s public URL, or recipients get a bare token they cannot use.

Privacy and safety properties

• Forgot-password always returns success, whether or not the address exists, so the endpoint cannot be used to discover accounts.
• Reset links are single-use: changing a password invalidates any outstanding link.
• The auth routes are rate-limited to 20 requests per minute per IP.
• Emails contain a link and nothing sensitive — no password, no token in a subject line, no watch content.

Choosing a provider

Any SMTP service works. For a personal instance, a transactional-email free tier is usually simplest; a personal mailbox’s SMTP works too, but be aware that consumer providers often rate-limit or rewrite the from address.

Troubleshooting

Symptom	Cause
Links appear in the console	SMTP_HOST not set — expected
Emails send but links are broken	APP_URL missing or wrong
Authentication failures	SMTP_USER/SMTP_PASSWORD — some providers need an app password rather than the account password
Mail is silently dropped	The from address is not authorised for the domain — check SPF and DKIM at your provider