DEV Community: thebrecht

How I migrated magic-link login from Resend to AWS SES + Lambda five days before launch

thebrecht — Mon, 25 May 2026 07:59:56 +0000

I run toui.io, a URL shortener I shipped to the public on April 7, 2026. Eleven days before launch I had passwordless email login working on Resend. Five days before launch I tore it out and rebuilt the same flow on AWS — Lambda + DynamoDB + SES + API Gateway, packaged as a SAM stack.

The whole migration took one afternoon. I want to write about why I did it, what the stack looks like, and the one thing I'd do differently.

This isn't a Resend hit piece. Resend is excellent for product engineers who want clean DX, a great API, and to never think about deliverability. If you're shipping a side project, use it. The math just changes when you start projecting actual production volume.

The math that pushed me off Resend

When I shipped the Resend version on March 27 the price was $0/month — toui.io was a side project sending zero emails. Then I sat down and projected the year-one cost curve.

Resend's pricing, at the time of writing (May 2026):

Tier	Monthly cost	Email cap
Free	$0	3,000/month (100/day)
Pro	$20	50,000/month
Pro	$35	100,000/month
Scale	$90–$1,150	100,000–2,500,000/month

AWS SES pricing, also today:

Volume	Monthly cost
First 3,000/month (first 12 months)	$0
Anything else	$0.10 per 1,000 emails

That's not a small gap. Some scenarios I sketched, with Resend on the right and SES on the left (Resend Scale tier breakpoints taken from the same pricing page):

Monthly volume	SES	Resend	Multiple
10,000	$1.00	$20 (Pro 50k)	20×
100,000	$10.00	$35 (Pro 100k)	3.5×
500,000	$50.00	$350 (Scale)	7×
1,000,000	$100.00	$650 (Scale)	6.5×
2,500,000	$250.00	$1,150 (Scale top)	4.6×

The 20× number at the low end isn't because SES is magic. It's because Resend Pro has a $20 floor — you pay the Pro fee the moment you cross 3,000 emails or 100/day, regardless of whether your actual usage is 10,001 or 49,999. SES's $0.10/1,000 is linear past the free tier.

For toui.io's profile — magic-link login + occasional product emails (welcome, billing receipts, announcements) — I was projecting somewhere between 10k and 100k emails per month in year one. That's solidly inside the "3.5–20×" cost-gap band.

And there's a second thing: Resend Free's 100/day daily cap. URL shorteners get viral spikes. A single shared post can dump 200 signups in an hour. Resend Free shuts that down at 100; Resend Pro fixes it but you're back on the $20+ tier. SES has no monthly cap and a per-second sending rate that scales up automatically as you build reputation.

The math said move now. Five days before launch is the worst possible time to do anything risky, but it's the best possible time to do something whose risk is "rebuild a working flow on a different vendor, in one well-isolated stack."

What I built

The whole magic-link service became a separate AWS stack, deployable independently of the Cloudflare Worker that hosts the rest of toui.io:

Frontend (toui.io)         API Gateway (auth.toui.io)        CF Worker (toui.io)
   │                            │                                │
   ├── POST /send {email} ─────►│                                │
   │                            ├─ DynamoDB: store token (TTL)   │
   │                            ├─ SES: send email with link     │
   ◄── 200 OK ──────────────────┤                                │
   │                            │                                │
   │  (user clicks email link)  │                                │
   │                            │◄── GET /verify?token=xxx       │
   │                            ├─ DynamoDB: validate + delete   │
   │                            ├─ 302 → /auth/magic-callback    │
   │                            │    ?payload=BASE64&sig=HMAC ──►│
   │                            │                                ├─ Verify HMAC
   │                            │                                ├─ D1: create session
   │                            │                                ├─ Set-Cookie
   │                            │                                ├─ 302 → /admin

The pieces, top to bottom:

AWS SAM packages the whole thing as one CloudFormation stack. sam deploy ships everything atomically.

DynamoDB holds tokens. Single table, partition key token (a UUID), with a TTL attribute set to now + 900s (15 minutes). Billing mode PAY_PER_REQUEST — at auth-flow volumes the bill is effectively zero.

One thing worth flagging clearly, because it's easy to miss: DynamoDB's TTL feature is opportunistic cleanup, not a security boundary. AWS's own docs say expired items are deleted "within a few days of their expiration time" — in practice that means the row can linger for up to ~48 hours past the TTL value. So if you let GetItem succeed and trust DynamoDB to have already swept the row away, you're effectively extending the token's lifetime from 15 minutes to up to ~48 hours.

The right shape is to enforce expiry at verify time and let TTL handle the eventual cleanup separately. Either an explicit check after GetItem:

const ttl = Number(result.Item.ttl?.N || '0');
if (ttl < Math.floor(Date.now() / 1000)) {
  return failureRedirect();
}

…or, even cleaner, push the freshness check into the atomic DeleteItem with a ConditionExpression, so a stale token can never both pass verification and get consumed:

await dynamo.send(new DeleteItemCommand({
  TableName: process.env.TOKENS_TABLE!,
  Key: { token: { S: token } },
  ConditionExpression: '#ttl > :now',
  ExpressionAttributeNames: { '#ttl': 'ttl' },
  ExpressionAttributeValues: { ':now': { N: String(Math.floor(Date.now() / 1000)) } },
}));

If the condition fails, the delete throws ConditionalCheckFailedException — catch it, redirect to the failure URL, done. TTL still does its background job; the row will eventually disappear. But the security of "15-minute magic link" is enforced by the verify handler, not by the cleanup mechanism.

This split — TTL for tidy housekeeping, conditional-write for real expiry — is the pattern I'd default to for any short-lived token table.

Lambda (Node.js 20.x, 128MB, 10s timeout) runs three routes:

POST /send — validate email, write token to DynamoDB, call ses:SendEmail
GET /verify — read token from DynamoDB, delete it, redirect to the Cloudflare Worker with an HMAC-signed payload
POST /send-email — generic email send for non-auth flows (welcome, billing, announcements); called by the CF Worker over HMAC

API Gateway HTTP API (v2) fronts the Lambda. Custom domain auth.toui.io, ACM cert, CORS limited to https://toui.io. Throttling: 10 req/s burst, 5 req/s sustained per route.

SES sends the actual email. Verified domain toui.io, custom MAIL FROM mail.toui.io, DKIM CNAMEs + SPF + DMARC all set during the cutover.

Secrets Manager holds HMAC_SECRET and FROM_EMAIL. Lambda reads on cold start and caches in a module-level variable, so warm invocations don't pay the API call.

The CF Worker side stays simple — it never touches DynamoDB. The only bridge between the AWS side and the Cloudflare side is the HMAC-signed redirect. AWS owns the token lifecycle; Cloudflare owns sessions. Neither code path needs cross-cloud credentials.

The cutover itself

Counter to how this story sounds, the migration wasn't dramatic. I had:

The design spec written that morning, after the math became clear
An existing Resend implementation to mirror for behavior (rate-limit, email body, error messages)
AWS SES already verified for toui.io (I'd done that the week before, "just in case")

By the afternoon the SAM stack was deployed, the Cloudflare Worker had been updated to call auth.toui.io instead of the old in-Worker Resend endpoint, and I'd manually sent test magic links from a few different email clients to make sure nothing landed in spam.

Total wall-clock time: about 6 hours. About 90 minutes of that was DNS propagation for the custom domain CNAME — the only step I couldn't speed up. The rest was code that I'd already mentally compiled by the time I started typing.

Surprises and the one thing I'd redo

SES out-of-sandbox: SES accounts start in sandbox mode (can only send to verified addresses). Production needs you to request out-of-sandbox via a support ticket, and AWS reviews it in ~24h. I'd done this previously for an unrelated project on the same account, so I was already approved in ap-northeast-1. If you're doing this fresh, file the ticket the day you create the account, not the day you need to ship.

Email warm-up: A new SES account starts in sandbox mode, capped at 200 emails per 24 hours and 1 email per second. Once you request and receive production access, your starting quota "varies based on your specific use case" (AWS docs language — in practice, a low starting limit that scales with reputation). For toui.io's pre-launch and early-launch traffic this was fine. If you're launching to thousands of users on day one, plan ahead with a dedicated IP and a warm-up schedule.

The one thing I'd redo: I shipped the Lambda's secrets reader as a per-invocation lookup before realizing how chatty that was. The fix is trivial — read on cold start, cache in a module-level variable so warm invocations skip the call — but the first deploy ate a few cents of Secrets Manager API calls before I noticed. AWS's own Lambda + Secrets Manager docs cover the pattern; follow it from the first commit, not the third.

Would I do it again?

Yes — but earlier. Sitting on Resend's free tier for the months before launch cost me nothing in money but cost me a sunk-cost-aware migration on the worst possible week. If I had projected my year-one volume the day I picked Resend, I'd have started on SES.

If you're prototyping and don't know your scale, Resend is still the right answer; the developer experience is genuinely better and the API is well-shaped. If you have a number — even a rough one — that crosses 10k emails/month in your projection, do the math early.

The AWS magic-link service is still the auth backbone of toui.io two months in. The SAM template, Lambda handlers, and email templates live in the aws/magic-link/ directory of the toui.io codebase. If anyone wants a sanitized stand-alone reference repo of just the SAM stack + Lambda code + DynamoDB schema, ping me and I'll cut one — it's small enough to be useful as a starting point for any side project that needs passwordless email auth.

If you've done the same migration in the opposite direction, or stuck with Resend at scale, I'd genuinely like to hear about it — hello@toui.io.

toui.io is a free URL shortener with permanent links, a free public REST API, OG/QR customization, and Telegram + LINE bots. The name is Taiwanese: to-ui — "where to?"

Automate Your Links: A Developer's Guide to the toui.io API

thebrecht — Sat, 11 Apr 2026 06:46:41 +0000

Your marketing team just dropped 50 product URLs into a shared spreadsheet. Subject line: "Flash sale this weekend -- need trackable links for all of these by Friday."

You open the spreadsheet. Fifty rows. Each one needs a short link with a descriptive title and social preview metadata, so the links look good when shared on LINE, Facebook, and X. You could open the toui.io dashboard, paste each URL one at a time, fill in the OG fields, copy the short link back... and repeat that 49 more times.

Or you could write a script that does it in 30 seconds.

This guide walks through exactly that. I built toui.io partly because I kept running into this exact scenario -- so the API is designed around it. By the end, you'll have a working promotion engine that creates short URLs, verifies them, and pulls campaign analytics. No browser required.

Update (May 2026): When this was published, API access was a paid-plan feature. It's now included on the Free tier -- 5,000 redirects/month, no card needed. The examples below work as-is on Free. (Read about the change)

Before you start

You'll need three things:

A toui.io account. The Free plan includes API access -- 5,000 redirects/month, no credit card required. Pricing details if you want to compare tiers.
An API key. Log into the toui.io dashboard, go to API Keys, and create one. You'll see it once -- copy it and save it to a .env file in your project root:

# .env
TOUI_API_KEY=toui_your_key_here

Make sure .env is in your .gitignore -- never commit API keys to version control.

Node.js 18+ (for built-in fetch) and dotenv for loading environment variables:

npm install dotenv

If you're on Node.js 20.6+, you can skip dotenv and use the built-in --env-file flag instead: node --env-file=.env create-links.js

Every code example in this guide reads the key from the environment. The first lines of every script should look like this:

import "dotenv/config";

const API_KEY = process.env.TOUI_API_KEY;
if (!API_KEY) {
  throw new Error("Missing TOUI_API_KEY in .env file");
}

That check runs first. If someone clones your repo and forgets to create the .env file, they get a clear error instead of a cryptic 401.

Step 1: Create short URLs

The endpoint is POST https://toui.io/api/v1/shorten. You send a JSON body with the target URL and optional metadata; you get back a short link.

Here's the simplest possible call:

const response = await fetch("https://toui.io/api/v1/shorten", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.TOUI_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://shop.example.com/products/wireless-earbuds-pro",
    title: "Wireless Earbuds Pro - Flash Sale",
  }),
});

if (!response.ok) {
  const err = await response.json();
  throw new Error(`API error ${response.status}: ${err.error}`);
}

const data = await response.json();
console.log(data);
// {
//   short_url: "https://toui.io/xK3mQp",
//   short_code: "xK3mQp",
//   target_url: "https://shop.example.com/products/wireless-earbuds-pro",
//   created_at: "2026-04-10T08:30:00.000Z"
// }

That's the core pattern: POST the URL, check response.ok, parse the result. Every example below follows this same shape.

Adding social preview metadata

When someone shares your short link on LINE or Facebook, the platform fetches Open Graph tags to render a preview card. toui.io lets you set these at creation time:

const result = await createLink({
  url: "https://shop.example.com/products/wireless-earbuds-pro",
  title: "Wireless Earbuds Pro - Flash Sale",
  og_title: "60% Off Wireless Earbuds Pro -- This Weekend Only",
  og_description: "Our top-rated earbuds at the lowest price ever. 48 hours only.",
});

The og_title and og_description fields are optional. If you skip them, social platforms will fall back to whatever metadata the destination page has. But for a flash sale where every click matters, controlling the preview card is worth the extra two lines.

You can also pass og_image_url if you have a hosted image URL for the card. It accepts any public https:// image link.

Choosing a custom short code

By default, toui.io generates a random 6-character code. But if you want something readable -- say, for a link you'll mention on a podcast or print on packaging -- you can request a custom code:

{
  url: "https://shop.example.com/flash-sale",
  title: "Weekend Flash Sale",
  custom_code: "sale426"
}
// Result: https://toui.io/sale426

Custom codes must be 4-8 alphanumeric characters. If the code is already taken, the API returns a 400 error. This is a paid-plan feature -- free accounts can only use auto-generated codes.

Processing 50 products in a loop

Now let's put it together. Here's a complete script that reads a product list and creates tracked short links for each one:

import "dotenv/config";

const API_KEY = process.env.TOUI_API_KEY;
if (!API_KEY) {
  throw new Error("Missing TOUI_API_KEY in .env file");
}

const API_BASE = "https://toui.io/api/v1";

// Your marketing team's product list
const products = [
  {
    name: "Wireless Earbuds Pro",
    url: "https://shop.example.com/products/wireless-earbuds-pro",
    discount: "60%",
  },
  {
    name: "USB-C Hub 7-in-1",
    url: "https://shop.example.com/products/usb-c-hub-7in1",
    discount: "45%",
  },
  // ... 48 more products
];

async function createLink(body) {
  const response = await fetch(`${API_BASE}/shorten`, {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify(body),
  });

  if (!response.ok) {
    const err = await response.json();
    throw new Error(`Failed to shorten ${body.url}: ${err.error}`);
  }

  return response.json();
}

async function main() {
  const results = [];

  for (const product of products) {
    const result = await createLink({
      url: product.url,
      title: `${product.name} - Flash Sale`,
      og_title: `${product.discount} Off ${product.name} -- This Weekend Only`,
      og_description: `Flash sale pricing on ${product.name}. Limited time offer.`,
    });

    results.push({
      product: product.name,
      short_url: result.short_url,
      code: result.short_code,
    });

    console.log(`Created: ${result.short_url} -> ${product.name}`);
  }

  console.log(`\nDone. Created ${results.length} short links.`);
  return results;
}

main().catch(console.error);

Run it, and 50 short links appear in your terminal. Each one is tracked, has social preview metadata, and is ready to drop into email campaigns, ad creatives, or social posts.

Step 2: Verify your links

Before handing the links to your marketing team, a quick sanity check never hurts. The GET /api/v1/urls/{code} endpoint returns everything toui.io knows about a short link:

async function getLink(code) {
  const response = await fetch(`${API_BASE}/urls/${code}`, {
    headers: {
      "Authorization": `Bearer ${API_KEY}`,
    },
  });

  if (!response.ok) {
    const err = await response.json();
    throw new Error(`Lookup failed for ${code}: ${err.error}`);
  }

  return response.json();
}

const link = await getLink("xK3mQp");
console.log(link);
// {
//   short_code: "xK3mQp",
//   target_url: "https://shop.example.com/products/wireless-earbuds-pro",
//   title: "Wireless Earbuds Pro - Flash Sale",
//   click_count: 0,
//   is_active: 1,
//   og_title: "60% Off Wireless Earbuds Pro -- This Weekend Only",
//   og_description: "Our top-rated earbuds at the lowest price ever. 48 hours only.",
//   og_image_url: null,
//   created_at: "2026-04-10T08:30:00.000Z"
// }

This is useful for spot-checking: confirm the target_url is correct, verify the OG fields are set, and make sure is_active is 1. You could also run this across all 50 links as a validation step before sending the spreadsheet back to marketing.

Step 3: Check campaign results

The sale is over. Time to see what worked. The GET /api/v1/urls/{code}/stats endpoint gives you click data with daily breakdowns and audience insights:

async function getStats(code, days = 7) {
  const response = await fetch(`${API_BASE}/urls/${code}/stats?days=${days}`, {
    headers: {
      "Authorization": `Bearer ${API_KEY}`,
    },
  });

  if (!response.ok) {
    const err = await response.json();
    throw new Error(`Stats failed for ${code}: ${err.error}`);
  }

  return response.json();
}

const stats = await getStats("xK3mQp", 7);
console.log(stats);
// {
//   short_code: "xK3mQp",
//   target_url: "https://shop.example.com/products/wireless-earbuds-pro",
//   total_clicks: 1284,
//   daily: [
//     { date: "2026-04-10", clicks: 412, unique_visitors: 389 },
//     { date: "2026-04-09", clicks: 507, unique_visitors: 461 },
//     { date: "2026-04-08", clicks: 365, unique_visitors: 330 },
//     ...
//   ],
//   countries: [
//     { country: "TW", clicks: 623 },
//     { country: "JP", clicks: 287 },
//     { country: "US", clicks: 194 },
//     ...
//   ],
//   referers: [
//     { referer: "facebook.com", clicks: 512 },
//     { referer: "line.me", clicks: 401 },
//     ...
//   ],
//   devices: [
//     { device_type: "mobile", browser: "Chrome Mobile", clicks: 743 },
//     { device_type: "desktop", browser: "Chrome", clicks: 412 },
//     ...
//   ],
//   limited: false
// }

A note on the limited field: the advanced breakdowns (countries, referers, devices) require a Pro or Business plan. On the Free plan you'll get a truncated preview with limited: true (top 3 of each dimension) -- enough to validate your integration. Upgrade to see the full breakdown.

Building a console report

Here's a quick script that pulls stats for every link from your campaign and prints a summary:

async function campaignReport(codes) {
  console.log("Product Link Report");
  console.log("=".repeat(60));

  let totalClicks = 0;

  for (const code of codes) {
    const stats = await getStats(code, 7);
    totalClicks += stats.total_clicks;

    const topCountry = stats.countries[0];
    const topReferer = stats.referers[0];

    console.log(`\n${stats.short_code} -> ${stats.target_url}`);
    console.log(`  Total clicks: ${stats.total_clicks}`);
    if (topCountry) {
      console.log(`  Top country:  ${topCountry.country} (${topCountry.clicks})`);
    }
    if (topReferer) {
      console.log(`  Top referrer: ${topReferer.referer} (${topReferer.clicks})`);
    }
  }

  console.log(`\n${"=".repeat(60)}`);
  console.log(`Campaign total: ${totalClicks} clicks across ${codes.length} links`);
}

// Pass in the short codes from Step 1
const codes = ["xK3mQp", "bR7nWz", /* ... */];
campaignReport(codes).catch(console.error);

That's your entire post-campaign analytics pipeline. No dashboards to click through, no CSV exports to wrangle. Just raw data you can pipe into whatever reporting tool your team already uses.

Production tips

Rate limits

toui.io enforces per-minute burst limits based on your plan:

Plan	Burst limit	Monthly API quota
Pro	200 req/min	500,000 req/month
Business	600 req/min	500,000 req/month

For 50 products, you won't come close to either limit. But if you're building something that creates thousands of links -- say, per-order tracking URLs for a high-volume store -- you'll want to pace your requests.

Handling 429 (rate limited)

If you hit the limit, the API returns a 429 status. A simple backoff strategy handles this gracefully:

async function fetchWithRetry(url, options, maxRetries = 3) {
  for (let attempt = 0; attempt <= maxRetries; attempt++) {
    const response = await fetch(url, options);

    if (response.status === 429 && attempt < maxRetries) {
      const body = await response.json();
      const delay = (body.retry_after || Math.pow(2, attempt)) * 1000;
      console.log(`Rate limited. Retrying in ${delay / 1000}s...`);
      await new Promise((resolve) => setTimeout(resolve, delay));
      continue;
    }

    return response;
  }
}

The 429 response body includes a retry_after field (in seconds) telling you exactly how long to wait. Every successful response also includes X-RateLimit-Remaining in the headers, so you can pace proactively if you need to.

Error codes at a glance

Status	Meaning	Common cause
400	Bad request	Missing `url` field, invalid custom code, or malformed JSON
401	Unauthorized	Missing or invalid API key
403	Forbidden	Custom code on Free plan, or URL flagged by Safe Browsing
404	Not found	Short code doesn't exist or belongs to a different team
429	Rate limited	Too many requests per minute or monthly quota exceeded

Always check response.ok before parsing. The error response body consistently has an error field with a human-readable message -- log it, and debugging becomes straightforward.

What you just built

In under 100 lines of JavaScript, you built a promotion engine that:

Creates 50 tracked short links with social preview cards
Verifies each link is correctly configured
Pulls post-campaign analytics with country, referrer, and device breakdowns

No dependencies beyond Node.js. No dashboard clicking. Just node create-links.js and the links are ready to ship.

This same pattern works for anything that needs tracked links at scale -- order confirmations, event invitations, newsletter campaigns, affiliate programs.

That's the whole API -- three endpoints, no SDK to install, just fetch. I built toui.io as a side project because I only needed about 5% of what tools like Bitly offer -- and paying $35/month for that didn't make sense.

There's a free tier with API access included if you want to kick the tires. If you're only creating a few links a week, the dashboard does the job fine. The API starts making sense when your marketing team sends you that spreadsheet.