Run double opt-in signup with Resend: confirm before the contact exists

TL;DR: A signup workflow that keeps unconfirmed addresses out of your audience: collect the email, send a confirmation link, create the contact only on click. Protects deliverability and keeps consent provable. Do not create a Resend contact yet; unconfirmed addresses must never enter segments or broadcasts. Send the confirmation email as a transactional send to the address the user typed.

The fix

1. On signup, store the email as pending in your own database with a signed confirmation token. Do not create a Resend contact yet; unconfirmed addresses must never enter segments or broadcasts.
2. Send the confirmation email as a transactional send to the address the user typed. If it bounces, you learn the address is bad before it ever touches your list.
3. Make the confirmation link single-use and time-boxed, for example 24 hours. When clicked, flip the record to confirmed and only then create the Resend contact.
4. If the link expires unclicked, keep the address out of your audience. Sending marketing to someone who never confirmed is how complaint rates spike.
5. Protect the signup form with CAPTCHA. Bots sign up fake addresses with no friction, and double opt-in alone does not stop them from polluting your pending table.
6. Log the confirmation event with timestamp and IP. Under CAN-SPAM and CASL you need clear consent evidence, and the click record is it.
7. After confirmation, fire your welcome automation from the confirmed event so the first mail they receive is the welcome, not a broadcast they never asked for. Docs: https://resend.com/docs/knowledge-base/audience-hygiene

When to use this

• This covers exactly what the title says: Run double opt-in signup with Resend.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Run; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Run behavior.

Verified against the Resend audience-hygiene docs on 2026-09-26: double opt-in means the confirmation link must be clicked before the address enters the audience, CAPTCHA blocks bot signups, and the confirmation record provides the consent evidence required under CAN-SPAM and CASL.