> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oncoeverything.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Email and payments

> How the platform sends email through SES and takes cards through Stripe.

## Email

All email goes through AWS SES from `notifications@mail.oncoeverything.com`. The sender is in `apps/api/src/mailer.ts`, and the templates are React Email components in `apps/api/src/emails`.

* SES verifies the domain with DKIM. SPF and DMARC records are in Route 53, from `infra/email.tf`.
* DMARC is at `p=none` for now. Move it to `quarantine`, then `reject`, when the DMARC reports are clean.
* New staff requests go to `REQUEST_NOTIFY_EMAIL`, which is [hello@oncoeverything.com](mailto:hello@oncoeverything.com).
* Locally, when `MAIL_FROM` is not set, the API prints each email to its console instead of sending it.

> [!WARNING]
>
> SES production access was requested in September 2026. Until AWS grants it, SES sends only to verified addresses, 200 a day. Check the status in the SES console under Account dashboard.

Staff can see every email template at `/internal/emails` on the site.

## Card payments

Stripe takes the card on its own hosted page. Card details never reach the platform.

**1. The buyer clicks Buy this report**

The API creates a Stripe Checkout session and sends the buyer to Stripe.

**2. Stripe calls the webhook**

Stripe posts to the API's `/webhooks/stripe`. The API checks the signature and records the event in `stripe_events`, so the API processes a repeated event only once.

**3. The API fulfills the order**

It creates a paid invoice, grants access to the report, queues a copy and sends the receipt.

The webhook listens for these events:

* `checkout.session.completed`
* `checkout.session.async_payment_succeeded`
* `checkout.session.async_payment_failed`
* `checkout.session.expired`

Payments turn on when `STRIPE_SECRET_KEY` and `STRIPE_WEBHOOK_SECRET` are in the app secret. Until then, **Buy this report** opens the inquiry form and the webhook answers 404.

Invoices paid by bank transfer do not go through Stripe. Staff record those payments by hand. See [Invoices](https://docs.oncoeverything.com/billing/invoices.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.