OAuth & Partner Integrations
Relevant source files
The following files were used as context for generating this wiki page:
The OAuth and partner integration module manages delegated access between users and third-party OAuth clients. It allows the Resend platform to track, list, and revoke permissions granted to external applications. This system ensures that partner integrations remain secure by providing mechanisms to invalidate access and refresh tokens when a grant is revoked.
The IResend interface defines the contract for managing these integrations, while the ResendClient provides the implementation for communicating with the Resend API. The primary data structure is the OAuthGrant, which encapsulates the relationship between a user, a client, and the specific scopes of access granted.
Sources: src/Resend/OAuthGrant.cs:7-11, src/Resend/IResend.cs:404-406
OAuth Grants Architecture
OAuth grants represent the specific authorization issued to an OAuth client. Each grant contains metadata about the creation time, the granted scopes, and the client details. If a grant is terminated, the system records the revocation time and the reason for revocation.
Sources: src/Resend/OAuthGrant.cs:11-54
Data Structures
The following table describes the primary fields within the OAuth Grant data model:
| Field | Type | Description |
|---|---|---|
Id | Guid | Unique identifier for the OAuth grant. |
ClientId | Guid | Identifier of the client the grant was issued to. |
Scopes | List<string> | List of permissions (e.g., emails:send) delegated to the client. |
Resource | string? | Optional resource restriction for the grant. |
MomentCreated | DateTime | Timestamp of when the grant was issued. |
MomentRevoked | DateTime? | Timestamp of revocation, if applicable. |
RevokedReason | string? | Description of why the grant was invalidated. |
Client | OAuthGrantClient | Object containing client display metadata. |
Sources: src/Resend/OAuthGrant.cs:16-53
Grant Relationships
This diagram illustrates the relationship between the Grant, the associated Client, and the Revocation outcome.
Sources: src/Resend/OAuthGrant.cs:11-105
Integration Management
The ResendClient manages integrations via the /oauth/grants endpoint. It supports paginated retrieval of all active grants and explicit revocation of specific grants using their unique identifiers.
Sources: src/Resend/ResendClient.OAuthGrants.cs:11-37
Grant Retrieval Flow
When listing grants, the client can apply PaginatedQuery parameters such as Limit, Before, and After. This allows for efficient navigation through large sets of partner integrations.
Revocation Logic
Revoking a grant is a destructive action that invalidates every access and refresh token issued under that specific grant. The SDK executes this via a DELETE request to the specific grant path.
Sources: src/Resend/IResend.cs:428-430, src/Resend/ResendClient.OAuthGrants.cs:34-37
public Task<ResendResponse<OAuthGrantRevoked>> OAuthGrantRevokeAsync( Guid oauthGrantId, CancellationToken cancellationToken = default )
{
var path = $"/oauth/grants/{oauthGrantId}";
var req = new HttpRequestMessage( HttpMethod.Delete, path );
return Execute<OAuthGrantRevoked, OAuthGrantRevoked>( req, ( x ) => x, cancellationToken );
}
Sources: src/Resend/ResendClient.OAuthGrants.cs:31-37
API Implementation
The internal API server implementation (used for testing and tools) handles the lifecycle of OAuth grants by simulating the Resend backend behavior.
| Endpoint | Method | Action |
|---|---|---|
/oauth/grants | GET | Returns a list of available OAuth grants. |
/oauth/grants/{id} | DELETE | Revokes the specified grant and returns revocation metadata. |
Sources: tools/Resend.ApiServer/Controllers/OAuthGrantController.cs:22-54
Event Notification via Webhooks
Partner integrations often rely on webhooks to receive updates about account activities. The system allows webhooks to be created, updated, and rotated for security. This is relevant to integrations because it enables partners to react to events like EmailDelivered or ContactCreated in real-time.
Sources: src/Resend/ResendClient.Webhooks.cs:33-40, src/Resend/ResendClient.Webhooks.cs:55-60
Conclusion
The OAuth & Partner Integrations system provides a structured way to manage third-party access to the Resend API. By utilizing the OAuthGrant model and the corresponding management methods in IResend, developers can monitor which external applications have access to user data and revoke that access as needed to maintain security and compliance.