Providers and webhooks

Providers connect Guardhouse to external email and object-storage services. Webhooks deliver tenant events to your systems.

Availability

Guardhouse Cloud may offer managed defaults depending on the plan and region. Custom-provider controls and credentials are tenant-specific. Self-hosted deployments must supply their own production providers.

Configure object storage

Guardhouse supports:

• Cloudflare R2;
• Amazon S3.

Object storage is used for tenant-managed content such as branding assets and user avatars.

Open Settings → Storage providers, choose a provider, and enter:

Provider	Required configuration
Cloudflare R2	Bucket, access-key ID, secret access key, and account endpoint
Amazon S3	Bucket, access-key ID, secret access key, and region

Use a dedicated private bucket and credentials restricted to the required bucket operations. Do not reuse an infrastructure-wide administrator credential.

1. Enter the provider values.
2. Use Test provider.
3. Resolve endpoint, region, credential, or bucket-permission errors.
4. Save the provider.
5. Upload and retrieve a test asset.

Switching storage

Do not assume that switching providers copies existing objects. Inventory current branding and profile assets, plan any required migration, and verify old and new assets before completing the change.

Configure email

Guardhouse supports these custom email providers:

• SendGrid;
• Amazon SES;
• Postmark;
• custom SMTP.

Open Settings → Email providers and select a provider. Configure the sender name and sender address plus the provider-specific credentials:

• SendGrid or Postmark API key;
• Amazon SES access key, secret, and region;
• SMTP host, port, username, and password.

Verify the sender address or sending domain with the provider before testing. For Amazon SES, also confirm the account is permitted to send to production recipients.

Use Send test email with the unsaved form values, confirm receipt, and then save. After a provider is active, stored credentials are hidden. To rotate them, enter and test the replacement credentials rather than expecting the existing secret to be displayed.

Customize email templates

Open Settings → Email templates to manage the messages used by invitations and authentication flows.

• Enable only templates required by the active flows.
• Use an accurate subject and accessible HTML body.
• Preserve variables recognized by the editor.
• Preview the template with the current branding.
• Send a test message.
• Use reset only when you intend to restore the Guardhouse default.

Test invitations, email verification, recovery, and magic links separately. A successful provider test does not prove that every template is active or correctly rendered.

Configure webhooks

Open Settings → Webhooks to register an endpoint and choose the event types it should receive.

1. Use an HTTPS endpoint controlled by your organization.
2. Copy the webhook secret when it is shown and store it in the receiving service's secret store.
3. Validate every signature before processing the event.
4. Return a successful response only after the event has been accepted for processing.
5. Use webhook logs to inspect delivery status and failures.

Start with the Webhooks overview, then follow:

• Set up a webhook
• Validate signatures
• Understand retries
• Review event types

Rotating a webhook secret requires a coordinated receiver update. Where your deployment allows an overlap, accept the old and new secret only for the shortest necessary transition.

Production checklist

• Keep development and production provider credentials separate.
• Store credentials outside source code and deployment logs.
• Use least-privilege bucket and email-provider accounts.
• Test provider failure and recovery, not only success.
• Monitor failed email and webhook delivery.
• Document owners, rotation dates, and recovery steps.
• Re-test providers and templates after domain or branding changes.