Customizing account emails

When a game turns on player accounts, Triggair sends the transactional auth emails on your behalf — signup confirmation, password reset, email change, magic link, invite, and reauthentication. By default each uses a clean built-in template. You can override any of them per game with your own HTML: subject + body, one template per email type.

Placeholders

Templates are plain HTML with a fixed set of placeholders that are substituted at send time (they are literal string tokens — never evaluated, so there is no template-injection surface). {{ConfirmationURL}} is the action link and is REQUIRED for every type except reauthentication — put it in an anchor. {{Token}} is a 6-digit code (used by reauthentication, or as a link alternative). {{Email}} is the recipient, {{GameName}} your game's name, {{SiteURL}} the players site, and {{RedirectTo}} the URL the player returns to. Unknown {{Tokens}} are sent literally and flagged as a warning when you save.

<a href="{{ConfirmationURL}}">Confirm your email</a>
<!-- or, for reauthentication: --> Your code: {{Token}}

What HTML is allowed (and what is stripped)

The HTML is sanitized to a safe email subset when you save (sanitize-and-store-clean): the stored template is the cleaned version, and the save response lists everything it removed. Allowed: text and structure (p, div, span, headings, lists, blockquote, pre/code), inline formatting (b/strong, i/em, u, s, small, sub/sup, font, center), links, images, and tables — all with inline style="" attributes. Removed: <script>, <style> blocks (use inline styles), <iframe>/<object>/<embed>/<form>, all on* event handlers, javascript:/data: URLs, and dangerous CSS (expression(), @import, url(javascript:)). This is enforced on every write path — dashboard, API, and MCP — so a malicious or broken template can never reach a player's inbox, and a template that fails to render falls back to the built-in default.

Where the confirm link lands

The action link returns the player to the URL your SDK passed as emailRedirectTo at signUp (it defaults to the current game page). That URL must be one of your game's allowlisted origins (Setup → Keys/CORS) — otherwise it's ignored and the link falls back to triggair.com. So set your allowed origins before relying on custom redirects.

Edit it: dashboard, API, or MCP

In the dashboard: Setup → Emails — pick a type, edit the subject and HTML, preview it, and save (the panel shows what was removed). Via the management API: GET /v1/dev/games/:id/email-templates returns the effective template for every type; PUT /v1/dev/games/:id/email-templates/:type sanitizes and stores; DELETE reverts a type to the default. Via MCP: triggair_get_email_templates, triggair_set_email_template, and triggair_reset_email_template — the set tool returns the removed[] and warnings[] so an agent can confirm its template was accepted as-is.

curl -X PUT https://api.triggair.com/v1/dev/games/$GAME/email-templates/signup \
  -H "Authorization: Bearer $DEV_TOKEN" -H "Content-Type: application/json" \
  -d '{"subject":"Confirm your email for {{GameName}}","html":"<p>Welcome! <a href=\"{{ConfirmationURL}}\">Confirm your email</a>.</p>"}'