> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notifique.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon SES (email)

> BYOK with Amazon SES: Access Key, Secret, region, aligned identities, and SNS events.

**Amazon SES** BYOK for email. You keep the AWS account; Notifique sends via the SES API with your credentials.

***

## Goal

With an **active** SES integration, sends try **your** SES account first. Failure → next BYOK (e.g. Resend) or Notifique internal fallback.

Each send consumes **1 email credit** on Notifique (or prepaid price), plus SES cost on **your** AWS account.

<Warning>
  SES **sandbox** accounts can only send to verified addresses. Request production access on AWS before real traffic.
</Warning>

***

## Credentials

In the dashboard (Settings → Integrations):

| Field                 | Use                           |
| --------------------- | ----------------------------- |
| **Access Key ID**     | IAM user/application          |
| **Secret Access Key** | Secret (stored encrypted)     |
| **Region**            | e.g. `us-east-1`, `sa-east-1` |

Auth type `CUSTOM` (`providerKey: aws_ses`).

***

## Suggested minimum IAM

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail",
        "ses:GetEmailIdentity",
        "ses:ListEmailIdentities",
        "ses:CreateConfigurationSet",
        "ses:CreateConfigurationSetEventDestination",
        "ses:DeleteConfigurationSet",
        "ses:DeleteConfigurationSetEventDestination",
        "sns:CreateTopic",
        "sns:DeleteTopic",
        "sns:Subscribe",
        "sns:SetTopicAttributes",
        "sns:Unsubscribe"
      ],
      "Resource": "*"
    }
  ]
}
```

Prefer scoping `Resource` to account/region when possible.

***

## Domains

On save:

1. ≥1 **VERIFIED** domain on Notifique
2. ≥1 verified / send-ready **domain identity** on your SES account
3. Hostname **overlap** (same rule as Resend)

At send time, `from` must use a Notifique-approved domain.

***

## Automatic provisioning

On connect, Notifique (using your credentials):

1. Creates a **configuration set** `notifique-…`
2. Creates an **SNS topic** and HTTPS subscription to\
   `{WEBHOOK_URL}/webhooks/email/ses/:integrationId`
3. Enables events `SEND`, `DELIVERY`, `OPEN`, `CLICK`, `BOUNCE`, `COMPLAINT`, `REJECT`

Existing integrations are auto-synced on the next workspace integrations list (updates the AWS configuration set).

### Opens and clicks

* **Native SES:** with tracking enabled on the configuration set (`PutConfigurationSetTrackingOptions`), `OPEN`/`CLICK` events arrive via SNS and update status + `email.opened` / `email.clicked` webhooks.
* **clicar.co:** with workspace auto-convert enabled, links in HTML/text become short links before send (API, dashboard, automation, notify), clicks also fire `email.clicked` via Notifique tracking.

On remove, tries to delete the configuration set and SNS topic.

***

## Sending

* API: **SES v2** `SendEmail`
* Integration `ConfigurationSetName` (for events)
* Tag `notifique_email_id` when available
* Dashboard history like other channels (`providerType: EXTERNAL`, `providerUsed: AWS_SES`)

***

## Failover

SES BYOK failure → next external provider → internal chain (ZeptoMail / platform SES).

***

## Workspace setup

1. Channel: `EMAIL`
2. Provider: `Amazon SES`
3. Access Key, Secret and region

After save, the Secret **does not** reappear in plaintext.

***

## Next steps

* **[BYOK hub](/en/byok)**
* **[Resend](/en/byok/resend)**