Custom Password Reset Email API Selection — Auth Template Ownership Without Webhooks

Select a compliant email API only after confirming its event records can be collected without webhooks. The authentication system must retain authority over the reset token and its validity, while the message sender must document which copy was actually sent. Treat an accepted API request as insufficient proof of delivery. A marketplace must control the legally reviewed notice text, its version, recipient selection, exact rendered content, and immutable content reference.

Compare email API options based on their ability to provide authenticated event retrieval, retention window, pagination, stable event identifiers, and cursor functionality. Record distinct states during the evidence chain: notice approved, recipient selected, send attempted, provider accepted, and delivery or failure event. Use a durable queue for sending and a separate event collector, ensuring each notice has an internal ID and immutable template version.

Store recipients and policy revisions securely, persist attempt IDs and provider message IDs, and deduplicate events using stable identifiers. Keep state transitions minimal and maintain separate credentials for polling with read-only access and rotation. Monitor for gaps in the evidence chain and address them before enabling production traffic.