Transactional emails

TLDR: WooshPayment sends both merchant-facing emails (verify, welcome, password reset, new order notification, Apple Pay alert) and the customer order confirmation, branded with the store name. We do not send automatic customer cart-recovery emails.

Emails WE send

Delivery: Resend, with DKIM + SPF configured on wooshpayment.com.

• Platform/merchant emails: WooshPayment <noreply@wooshpayment.com>
• Customer order emails: {Store Name} <noreply@wooshpayment.com> by default, or {Store Name} <verified fromEmail> if you configured a verified sender

Email	When it fires	Recipient
email_verify	Immediately at signup	Merchant
welcome	Immediately at signup	Merchant
password_reset	When the merchant requests reset	Merchant
customer_order_confirmation	After Whop/COD payment and store order creation	End customer
merchant_order_notification	On every completed/COD order	Merchant
apple_pay_registration_required	If Apple Pay auto-registration on the merchant's Whop fails	Merchant

Why we send the customer order confirmation

Updated product decision:

1. Branding: the customer sees the store name as sender and a store-only footer, not a generic "WooshPayment" email.
2. Language: the confirmation uses the checkout/funnel language when available, instead of the store's default language.
3. No duplicate Shopify receipt: for Shopify orders created via API we set send_receipt: false, so Shopify does not send a second order confirmation.
4. Observability: after the Whop webhook we record server_customer_order_email, so checkout debugging shows whether the provider accepted the email.

What this means in practice:

• Customer pays on WooshPayment → Whop webhook → we create the order via Shopify/Woo API → we send the branded customer order confirmation → we send the merchant order notification.
• Shopify: the native receipt is disabled on order create to avoid duplicate emails.
• WooCommerce: the order still lives in Woo and Woo emails may depend on merchant settings/plugins, but the WooshPayment confirmation is the one certified by our money-path gate.
• Customer abandons cart mid-flow → we do not send automatic customer recovery emails. The abandoned-cart cron handles housekeeping and only sends recovery where explicitly configured.

DNS required on the WooshPayment side (already configured)

For those who want to know our current sender configuration:

SPF (on the wooshpayment.com apex):

v=spf1 include:secureserver.net include:_spf.resend.com -all

secureserver.net is GoDaddy mail (default), _spf.resend.com authorizes Resend to send on our behalf.

DKIM (CNAME resend._domainkey.wooshpayment.com):

Configured per the records provided by the Resend dashboard.

DMARC: published in monitoring mode (p=none). Before full money-path certification we move it to at least p=quarantine.

Pre-production testing

When we add a new template (platform-side):

1. Resend dashboard → "Send test"
2. Verify rendering on Gmail, Outlook, Apple Mail (Outlook is the worst)
3. Test on mail-tester.com — we aim for ≥9/10
4. Verify anti-XSS escaping on all user-provided fields (shopName, customer.firstName, etc.)

Outlook spam folder

It happens that the first email to an Outlook/Hotmail recipient lands in Junk. It's normal for new sender domains. Solutions:

1. Recipient marks "Not spam" on first arrival → subsequent ones arrive normally
2. Add noreply@wooshpayment.com to contacts
3. See Email not arriving for full diagnostics

Customization

Templates aren't editable from the merchant dashboard today (they're hardcoded in apps/api/src/services/EmailService.ts with XSS escaping on all dynamic fields). Colors, logo, support email and verified custom sender can come from the store checkout configuration.

Useful links

• Email not arriving — deliverability debugging
• Whop Setup
• Shopify integration