[SOLVED] Password Recovery Emails Not Sending in Production (Works on Localhost)

Like what I've got here

TL;DR

Password recovery emails not sending in production but working on localhost. Solution involved adding the production domain to Appwrite's Domain Whitelist. The issue was related to the URL host not being accepted.

yes, one sek

I'm not entirely sure which other images you're looking for besides thees ones.

Sure, I think I know the issue. On the overview page of your project, scroll towards the bottom. You should see a header for integrations and a pink button that says add platform. Click that button, then click web app, fill out this form putting the domain of your web application in. This should whitelist your domain.

I believe this is a security measure to prevent people from highjacking recovery tokens or something

It also is what prevents CORS errors if you didn't setup your own subdomain for appwrite

Please note that in order to avoid a Redirect Attack the only valid redirect URLs are the ones from domains you have set when adding your platforms in the console interface.

https://appwrite.io/docs/references/cloud/client-web/account#updateRecovery

Tbh, i dont see the header "integrations" under overview.

it is in appwrite, right?

nvm, i found it

sorry

My bad, I think the UI changes when you add one

After you add a platform the UI for adding one changes lol, I was referencing that. Going to add this just incase someone else has the same issue and finds this support post.

Thanks, you are a big help.

Did that work out for you?

can i ask you to be sure, what should i put as Hostname and Name?

Name is purely vanity for you to know what it's for, for hostname you would put the domain of your app leaving out the http(s)://

So for example, if I have the website https://kennethbass.com, and want to add it I would put kennethbass.com in the hostname.

should i use my base url ad the hostname or the appwrite CNAME i mead?

Or if I had a subdomain of https://cdn.kennethbass.com, I could do cdn.kennethbass.com or *.kennethbass.com. The wildcard allows any subdomain on my main domain to be whitelisted, this is fine if you own the domain, but if you're using something like vercel.app then you probably don't want to do that because you've now just whitelisted any vercel.app domain on your appwrite instance.