Observe first. Send safely.

First 10 minutes

1. Create an account and start the 14-day trial (no card).
2. Create an AWS connection in Settings and download the CloudFormation template.
3. Create the stack in your SES region, then paste RoleArn, SnsTopicArn, and ConfigurationSetName.
4. Verify the connection and confirm the SNS subscription for SES events.
5. Verify a sender domain (DKIM / SPF / DMARC) on Domains.
6. Create a project, assign the connection, mint an as_ API key, and send a test email.

1. Prepare Amazon SES in your AWS account

AllStackd does not host mail and does not issue “SES API keys.” Delivery charge stays on your AWS bill. Complete these steps in the AWS console (or equivalent IAM/SES APIs) before Control-mode traffic.

1. Sign in to an AWS account you control and pick the region where you will send (for example eu-central-1 or us-east-1). SES quotas and sandbox status are per region.
2. Open Amazon SES → create and verify a domain identity you own. Add the Easy DKIM CNAME records (and SPF / DMARC as recommended) at your DNS host. Do not use Gmail, Outlook, iCloud, or Yahoo as the sending domain.
3. Check sandbox vs production. New SES accounts start in the SES sandbox: you can only mail verified recipients (and the mailbox simulator), with low daily quotas. When you are ready for real users, request production access from the SES Account dashboard (mail type: usually Transactional for product email). AWS reviews the request; AllStackd cannot approve it for you.
4. Connect AllStackd with CloudFormation — not access keys. In AllStackd → Settings, create a connection, download the generated template, then in AWS CloudFormation choose Create stack → With new resources → Upload a template file. After the stack finishes, copy the RoleArn, SnsTopicArn, and ConfigurationSetName outputs back into AllStackd and verify. The stack embeds a unique External ID so only AllStackd’s runtime role can assume your role.
5. Confirm the SNS subscription for SES events if AWS emails a confirmation link. AllStackd verifies signed SNS messages against the topic ARN stored on the connection.

Do not create IAM user access keys or SES SMTP credentials for AllStackd. If a guide asks you to “generate SES keys,” stop — that path is for other products. AllStackd’s path is role assumption only.

Troubleshooting

CloudFormation stack rolled back

Open the failed stack events in AWS. Common causes: missing IAM permissions to create roles/topics, or an invalid SNS HTTPS endpoint. Fix the cause, delete the failed stack, and create again from a fresh AllStackd template download.

AssumeRole failed / External ID validation failed

Confirm you pasted the RoleArn from this connection’s stack, not another environment. The trust policy must name AllStackd’s runtime role and the exact External ID from Settings. Re-download the template if you recreated the connection.

SNS subscription pending

Confirm the subscription in the SNS console or via the AWS confirmation email. Until it is Confirmed, SES events will not reach AllStackd and health findings stay empty.

Still in the SES sandbox

You can only mail verified recipients until AWS approves production access. Request it from the SES Account dashboard; AllStackd cannot approve the request for you.

DKIM pending or drift

Publish the three Easy DKIM CNAMEs at your DNS host and wait for SES to show Successful. Drift findings mean a CNAME was removed or changed — restore the records SES expects.

Control mode unavailable

The connection must be active in Control permissions mode, the project must be assigned that connection, the sender domain must be verified, and the workspace needs an active trial or paid plan.

Email stuck in queue

Check Overview for dead delivery jobs and Settings for AWS connection errors. Quota, suppression, or AssumeRole failures move jobs to dead letter rather than silent drop.

Signed customer webhooks

Settings can create public HTTPS endpoints for send, delivery, bounce, complaint, and reject events. Verify allstackd-signature as HMAC-SHA256 over timestamp + "." + rawBody, compare in constant time, reject timestamps older than five minutes, and deduplicate on allstackd-event-id.

Errors and retries

Draft templates return 409 template_not_published. Retry network errors and 5xx responses with the same Idempotency-Key. Do not automatically retry validation, authentication, suppression, or plan-limit errors. If a Control send times out after the SES request may have been accepted, the message status becomes unconfirmed and AllStackd will not resubmit it. Confirm delivery before sending a replacement with a new idempotency key; a later SES event can still advance the status.

MCP beta

API-key MCP: https://allstackd.com/api/mcp (Bearer as_…). OAuth MCP for ChatGPT / Codex: https://allstackd.com/mcp (Clerk sign-in). Claude Connectors Directory listing is paused (requires Anthropic Team/Enterprise).

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "send_email",
    "arguments": {
      "from": "hello@your-verified-domain.com",
      "to": ["customer@example.com"],
      "template": {
        "alias": "welcome",
        "variables": { "first_name": "Ada", "product_name": "Acme", "action_url": "https://app.acme.com/start" }
      }
    }
  }
}

Agent plugins

The connector pack (manifests + skill + remote MCP client config) is public at github.com/kondasviktor/allstackd-plugin. It is not the AllStackd product source. Set ALLSTACKD_API_KEY after install.