Which email providers can I connect?

Three options

Provider	Auth	Best for
Microsoft 365	OAuth (client_id + tenant_id + client_secret)	Teams running on Microsoft 365
Google Workspace	OAuth (refresh_token via consent flow)	Teams running on Google Workspace
Resend	API key	Anyone — easy to set up, transactional

Connecting Microsoft 365

1. Register an app in Azure AD (Application permissions: Mail.Send)
2. Grant admin consent
3. In Settings > Email > Microsoft 365 > Connect, enter tenant ID, client ID, client secret
4. Set from_address to the licensed mailbox (typically hr@yourdomain.com)
5. Click Activate

Connecting Google Workspace

1. Set up an OAuth client in Google Cloud Console
2. Enable Gmail API + add gmail.send scope
3. In Blankitt HR, click Connect — you'll be redirected to consent
4. Authorise; you're back in HR with the connection active

Resend

Just paste your Resend API key + verified from_address. Cheapest path.

Fallback

If no provider is configured, HR routes mail through Blankitt's own email service (M365 primary, Resend failover) — the same chain the rest of Blankitt uses. Limited custom-domain support; fine for invites and self-service emails to your team.

Why one active at a time

Switching providers mid-flight could split delivery between two; the toggle is exclusive to avoid confusion. Deactivate before swapping.