Email & push notifications

Resend (transactional email)

• Verify your sending domain in Resend before production; use [email protected] only for quick tests.
• Keep RESEND_FROM_EMAIL aligned with the verified domain.
• Send order confirmations and ticket updates from trusted paths (e.g. after webhook success), not from the client.

Firebase Cloud Messaging (push)

• Create a Firebase project; enable Cloud Messaging for the web app.
• Store VAPID / service account material in server env; never expose service account JSON to the browser.
• In the UI, explain why notifications help and surface permission state — users who deny permission still need clear in-app messaging.

Good practice

Treat email and push as best-effort: log failures, do not fail Stripe webhooks solely because Resend returned an error if the order is already saved (or retry in a queue).