How to Send Email from a Lovable App

​

Prerequisites

• A Lovable project with Lovable Cloud enabled
• Authentication enabled for the app
• An AhaSend account with a verified sending domain
• An API key with a send scope, plus your account ID

​

Store the Key as a Secret

AHASEND_API_KEY=aha-sk-...
AHASEND_ACCOUNT_ID=your-account-uuid
AHASEND_SANDBOX=true

​

Prompt Lovable for a Backend Send

“When a signed-in user requests their welcome email, send it through AhaSend from an Edge Function, never from the frontend. Authenticate the caller with withSupabase({ auth: 'user' }), keep JWT verification enabled, and derive the recipient email and stable idempotency key from the verified user claims rather than request JSON. Import AhaSendClient from npm:@ahasend/sdk, read AHASEND_API_KEY, AHASEND_ACCOUNT_ID, and AHASEND_SANDBOX with Deno.env.get(), reject missing configuration at startup, check every returned recipient status, and never log recipients, content, secrets, request bodies, or whole errors. The frontend should invoke the Edge Function with the signed-in user’s session, not call AhaSend directly.”

import {
  AhaSendAPIError,
  AhaSendClient,
  isAhaSendError,
} from "npm:@ahasend/sdk";
import { withSupabase } from "npm:@supabase/server@^1";

function requireEnv(name: string): string {
  const value = Deno.env.get(name);
  if (!value) throw new Error(`Missing required environment variable: ${name}`);
  return value;
}

function requireBooleanEnv(name: string): boolean {
  const value = requireEnv(name);
  if (value !== "true" && value !== "false") {
    throw new Error(`${name} must be true or false`);
  }
  return value === "true";
}

const ahasend = new AhaSendClient({
  apiKey: requireEnv("AHASEND_API_KEY"),
  accountId: requireEnv("AHASEND_ACCOUNT_ID"),
});
const sandbox = requireBooleanEnv("AHASEND_SANDBOX");
const environment = sandbox ? "sandbox" : "live";

export default {
  fetch: withSupabase({ auth: "user" }, async (req, ctx) => {
    if (req.method !== "POST") {
      return Response.json(
        { error: "Method not allowed" },
        { status: 405, headers: { Allow: "POST" } },
      );
    }

    const userId = ctx.userClaims?.id;
    const email = ctx.userClaims?.email;
    if (typeof userId !== "string" || typeof email !== "string") {
      return Response.json({ error: "Authenticated user has no email" }, { status: 400 });
    }

    try {
      const result = await ahasend.messages.send(
        {
          from: { email: "hello@yourdomain.com", name: "Your App" },
          recipients: [{ email }],
          subject: "Welcome aboard",
          html_content: "<p>Thanks for signing up.</p>",
          text_content: "Thanks for signing up.",
          sandbox,
        },
        { idempotencyKey: `welcome-${environment}-${userId}` },
      );

      const rejectedCount = result.data.filter((r) => r.status === "error").length;
      if (rejectedCount > 0) {
        console.warn("AhaSend rejected recipients", { rejectedCount });
        return Response.json({ error: "Email was not accepted" }, { status: 502 });
      }

      return Response.json({ queued: true }, { status: 202 });
    } catch (err) {
      if (isAhaSendError(err)) {
        console.error(
          "AhaSend request failed",
          err instanceof AhaSendAPIError
            ? { errorCode: err.code, status: err.status, requestId: err.requestId }
            : { errorCode: err.code },
        );
        return Response.json({ error: "Failed to send email" }, { status: 502 });
      }
      throw err;
    }
  }),
};

​

Verify Where the Key Landed

​

Test in Sandbox Mode

​

Going Further

• Templating: pass substitutions per recipient and use {{ variable }} in the subject or body.
• Batch sends: recipients accepts up to 100 entries, each of which gets its own message.
• Webhooks: AhaSend signs every webhook with the Standard Webhooks scheme, and WebhookVerifier from @ahasend/sdk/webhooks verifies it on Deno. A receiver arrives with no user session, so it needs auth: "none" plus verify_jwt = false under [functions.<name>] in supabase/config.toml — the one place in this guide where a public function is correct, because the signature becomes the only thing authenticating the caller. That also makes its body attacker-controlled, so read it through the module’s bounded adapter rather than buffering whatever arrives: const handle = nextRouteHandler(verifier, callback, { maxBodyBytes: 1_000_000 }) takes a web-standard Request despite the name, so withSupabase({ auth: "none" }, (req) => handle(req)) wires it up. It streams the signed bytes, stops above your limit, and calls your callback only once the signature checks out. Verification covers those exact bytes, so re-serializing await req.json() changes them and the check will never pass. A valid signature still does not make a delivery unique: before the handler does anything durable, commit the verified webhook-id in the same database transaction as that work, await that commit before you return, and answer repeats with a 2xx. The Cloudflare Workers guide shows the same pattern on another edge runtime.
• Attachments, scheduling, tags: all available on the same endpoint. See the API reference.
• Moving the send to a Node server: the Express guide covers the Node imports, environment access, and route integration.
• Building in a different AI tool? See v0 and Bolt.new.

​

Troubleshooting