Email and invites

Member invitations, email verification, and password resets are delivered by email: configure SMTP or invites can’t go out. Bloom and Bud read the same keys (prefixed aliases like BLOOM_SMTP_HOST are accepted when both run on one host):

SMTP_ENABLED=true
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_USERNAME=replace-with-smtp-username
SMTP_PASSWORD=replace-with-smtp-password
SMTP_FROM_EMAIL=noreply@example.com
SMTP_REPLY_TO=support@example.com
SMTP_STARTTLS=true
SMTP_SSL=false
SMTP_TIMEOUT_SECONDS=30

SMTP is optional for an installation that uses only the initial administrator. It is required for invitations, password resets, email verification, and approved email changes. SMTP_ENABLED is false in the shipped .env.example: set it to true and configure the SMTP host, sender, authentication, and TLS values before using those workflows.

Links in emails

Set APP_BASE_URL to the public URL of your Bloom instance, such as https://bloom.example.com. Bloom uses it in the links it emails (invites, email verification, password resets) and in campaign links. The shipped default is http://localhost:8000.

One-time links (invitation, email verification, password reset, email change) carry their token only in the URL fragment and are single-use. This keeps tokens out of request targets, server logs, and the Referer header.

Token lifetimes

Token lifetimes are configurable: invites last 72 hours, email verification 24, password resets 2. Change them with INVITE_TOKEN_TTL_HOURS, EMAIL_VERIFICATION_TOKEN_TTL_HOURS and PASSWORD_RESET_TOKEN_TTL_HOURS.

Setting	Default	Applies to
INVITE_TOKEN_TTL_HOURS	72	Invitation
EMAIL_VERIFICATION_TOKEN_TTL_HOURS	24	Email verification
PASSWORD_RESET_TOKEN_TTL_HOURS	2	Password reset

A different SECRET_KEY invalidates pending invite and reset links, so keep it stable across restarts and upgrades.

Email changes

Email changes require the current password. Administrators confirm the change from their current mailbox, then verify the new mailbox. Other users need administrator approval before verification is sent to the new address. Completing the change ends existing sessions, so sign in again.

A user requests the change; an administrator approves or rejects it; the new mailbox must confirm before the login changes. Administrators can start the same confirmed workflow for a user. An administrator cannot replace an address directly through user editing.

Other email Bloom sends

• First-run setup. Creating the first administrator at /setup sends a confirmation email, best effort.
• Access requests. A request is emailed to every active administrator. Without SMTP the request is still recorded and shown under Access, Requests and on the project’s members page, and the user is told the email could not be sent. See Roles and access.
• Document reviews. Review and approval requests on controlled documents produce notifications and email.

Cloudron

On Cloudron, Bloom maps the sendmail variables of the optional Email addon. Email (invitations, password resets and address changes) works only if you enabled that addon for the app. Without it, the administrator you create at /setup is the only way in.