ALEX STUDIO HQ / DOCUMENTATION

Current setup guides.

A checklist of the recent HQ capabilities, what is deployed, and what each product still needs to configure.

Product reports

The shared report API, SDK helper and private Reports inbox are available. Enable reports on the project and backend key, then add the product form/backend. This uses HQ storage and no email provider. Complete reporting guide →

Verification email with Resend SMTP

The gateway and website-account service send through Resend using smtp.resend.com, port 465, immediate TLS, username resend, and sender alex@alexstudiohq.com. SMTP_PROVIDER=resend selects the sending-only domain-restricted RESEND_SMTP_PASSWORD Secret. The original SMTP_PASSWORD remains for explicit rollback only; there is no automatic fallback. The owner's live test was received in Gmail.

The email API needs email on the project and its key. Sending a code does not verify a user: the product must securely generate, hash, expire and consume codes. The existing website-account service already has a hashed six-digit, five-minute, single-use OTP with resend/guess protection. Its separately maintained frontend needs a code-entry flow and backend proxy before required verification is enabled. Email and registration guide →

Sending and receiving limits

Resend Free currently allows 100 sent and received emails combined per UTC day and 3,000 combined per month, shared across your products. In Nigeria the daily reset is 1 a.m. The domain is verified for sending; receiving is currently disabled. Receiving would require its own MX routing and app integration, and uses the same email allowance. The gateway's internal 500-attempt safeguard does not raise Resend's limit. Check Resend's current limits before planning capacity.

Subdomains for external products

A website can use an HQ-managed subdomain without calling the HQ API or having any project key. Add it to the hosting provider first, then copy the exact routing and ownership records into HQ Domains. Short names expand under alexstudiohq.com; supported Vercel ownership TXT records can use the shared _vercel label while naming the exact project subdomain. Save records as a proposal, review/apply explicitly, then verify in the hosting dashboard. No DNS changes happen just by opening a form or saving a proposal. Step-by-step domain guide →

DNS connection diagnostics

HQ → Domains → Test DNS connection reads Cloudflare DNS without writing records. Save DNS_API_TOKEN as only its token value, with no Bearer prefix, quotes or extra lines, and DNS_ZONE_ID as the zone ID. Use a zone-scoped token for alexstudiohq.com with DNS Read/Edit for application. A successful read test does not prove Edit permission; applying a proposal checks the write. The Worker redirect-mode issue is fixed. If a request outcome is unknown, inspect the saved proposal and Cloudflare records before applying again.

Other integration guides

Keep project keys in each product backend. The public documentation and SDK grant no permissions by themselves. Existing products keep their scopes until you change them in HQ.