Resend OAuth 2.0 connector profile – StackOne setup guide

There is no dashboard screen for this — you register the client by sending a single
JSON request to POST https://api.resend.com/oauth/register with
Content-Type: application/json. Register a confidential client so that Resend issues
a Client Secret, and include the Callback URL from your Connector Profile as a
redirect URI. Run the following curl command, replacing <callback_url> with that
Callback URL and the scope value with the scopes you need (see the next step):

curl -X POST 'https://api.resend.com/oauth/register' \
  -H 'Content-Type: application/json' \
  -d '{
    "client_name": "StackOne Integration",
    "redirect_uris": ["<callback_url>"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "client_secret_post",
    "scope": "full_access"
  }'

• client_name — a descriptive name for the client, such as StackOne Integration. Any name works; it is only a label.
• redirect_uris — must include the Callback URL from your Connector Profile.
• grant_types — include both authorization_code and refresh_token. The refresh_token grant is required so StackOne can refresh the access token once it expires.
• token_endpoint_auth_method — set to client_secret_post, because StackOne sends the client credentials in the request body when exchanging and refreshing tokens. This makes Resend issue a Client Secret for the confidential client.
• The response returns a client_id and a client_secret. The Client Secret is returned only once at registration and cannot be retrieved later — store it securely.

Public clients use a different flow and do not require a Client Secret. Use this step instead of the previous one if you don’t need the Client Secret to be validated.

• Send the same POST https://api.resend.com/oauth/register request, but set token_endpoint_auth_method to none instead of client_secret_post.
• Resend returns only a client_id — no Client Secret is issued, and the client authenticates with PKCE alone, so the Client Secret is never verified.
• This still connects — enter any placeholder value in the required Client Secret field in StackOne, since Resend never checks it for a public client.

Scopes are not set in Resend’s UI — they are the scope field in the same POST https://api.resend.com/oauth/register request body from the previous step, given as a single space-separated string (for example "scope": "full_access"). Use full_access for all API routes, or emails:send to only send email. If you omit scope at registration, Resend registers the client with both scopes by default.

Paste the returned client_id into the Client ID field and the client_secret into the Client Secret field in the StackOne Connector profile. In the Scopes field, enter the space-separated scopes you registered, such as full_access.