title: Should an API service send the user activation email or the client application?
body: <p>I'm trying to develop a REST API web service. I have a question about how to handle user activation email. Currently, the API service handles email sending.</p>
  
  <p><strong>Here is the flow I have at the moment:</strong></p>
  
  <ol>
  <li>User registers via the client application</li>
  <li>Client application POSTs to API service </li>
  <li>API service validates and adds the user to the database</li>
  <li>API service sends the User an activation link</li>
  <li>User clicks on the activation link, which will take them to the client application activation page</li>
  <li>Client application activation page POSTs to API service</li>
  <li>Done</li>
  </ol>
  
  <p><strong>Here is where I currently see the issue:</strong></p>
  
  <p>Because the API service is currently sending the email, the client application does not have control over the look and feel of the email. And there may be URLs in the email that should point to the client application.</p>
  
  <hr>
  
  <p>Another option is instead of the API service sending the activation email, it will return the activation key to the client application. The client application will then be able to send the activation email to the user.</p>
  
  <p><strong>Two issues I see with this strategy:</strong></p>
  
  <ul>
  <li>Security, as the activation key is now exposed to the client application.</li>
  <li>Not DRY, as each client could be responsible for email sending.</li>
  </ul>
  
  <p><strong>What do you think is best way to handle this?</strong></p>
  
  <p>I would like to allow the client application to customize their email, as well as include client-specific URLs (activation page).</p>