---
title: "Get Email Debug"
method: GET
path: "/api/admin/email-debug"
tags: ["Admin"]
---

# Get Email Debug

`GET /api/admin/email-debug`

## Request

- Base URL: `https://api.xfinlab.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.xfinlab.com/api/admin/email-debug`
- Auth: none declared

2026-08-27: diagnostic for the "Key was issued but the confirmation
email failed to send" error AJ hit on the self-serve Intelligence API
signup flow. services/email_service.py's EmailService.send() only ever
logs `print(f"Email error: {e}")` to server stdout on failure -- not
visible from the outside, and this whole SMTP path can't be exercised
from the sandbox (no route to Railway's outbound network / real SMTP
creds). This endpoint surfaces exactly which step fails and why,
without needing Railway CLI log access.

Step 1 (always runs, no side effect): reports whether each required
env var is SET (never the actual secret value) plus the non-secret
SMTP_HOST/SMTP_PORT values, then attempts connect -> starttls -> login
against the real configured SMTP server, reporting the exact exception
and which of those three steps it happened at. This alone diagnoses
the overwhelming majority of "email failed" cases (missing env var,
wrong host/port, revoked app password, provider blocking the IP) with
zero risk of actually sending anything.

Step 2 (opt-in via send_test=true&test_to=you@example.com): only after
step 1's login succeeds, sends one real test email so AJ can confirm
delivery end-to-end (not just that auth works) -- e.g. Namecheap/Gmail
can accept a login but still silently drop mail past that point.

2026-08-27: now branches on RESEND_API_KEY first (see services/
email_service.py's module docstring -- Railway blocks outbound SMTP
below its Pro plan, confirmed via this exact endpoint's `connect:
"FAILED: timed out"` result against mail.privateemail.com:587). When
RESEND_API_KEY is set, this checks Resend's HTTP API instead (GET
/domains, which validates the key without sending anything) and skips
the SMTP connect/starttls/login walk entirely, since EmailService.send
itself would do the same -- this endpoint should diagnose whichever
path send() actually takes, not a path it no longer uses.

## Query parameters

- `token` string, required
- `send_test` boolean
- `test_to` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/xfinlab/apis/xfinlab-api.md) · [All operations](https://skmtc.dev/xfinlab/apis/xfinlab-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xfinlab/apis/xfinlab-api/revisions/205f85614bc6?raw)