# Email notifications

seekrit sends transactional emails for security-significant events — a new service token, an
access grant, an expiring credential. They keep you aware of who can reach your secrets without
opening the dashboard.

> **Note:** Notification emails carry only metadata already in your audit log — names, roles, timestamps, organization and environment names, and links. They **never** contain secret values, ciphertext, private keys, passphrases, or token strings.

## What seekrit sends

| Email | When | Who receives it |
| --- | --- | --- |
| Service token created | A service token is minted in an organization | Owners & admins |
| Service token revoked | A service token is revoked | Owners & admins |
| Environment access granted | You're granted a key for an environment | The person granted access |
| Environment access revoked | Your access to an environment is removed | The person affected |
| Denied-access alerts | A principal is denied when resolving secrets | Owners & admins (throttled to one per environment per hour) |
| Welcome & key setup | You join or create an organization | You |
| Service token expiring | A token expires within 7 days | Owners & admins (sent once per token) |
| Temporary credential expired | A lease reaches its expiry and is revoked | The lease owner & admins |
| Third-party sync failed | A sync to an external destination stops retrying, leaving it stale | Owners & admins |
| Honey token tripped | Someone tries to use one of your [decoy credentials](/docs/guides/honey-tokens) | Owners & admins (throttled to one per decoy per hour) |
| Secret rotation failed | A [scheduled rotation](/docs/guides/rotation) can't complete | Owners & admins (on the first failure and again if it gives up) |

## Managing your preferences

Each type has its own on/off switch. In the dashboard, open the account menu (top right) →
**notification settings**, or go to `/account/notifications`. Toggling a switch saves
immediately. Preferences are per-user and apply across every organization you belong to. All
types are on by default.

Every email also includes a **Manage which emails you receive** link in its footer that leads to
the same page.

Or from the CLI:

```bash
seekrit notifications                        # every type, on or off
seekrit notifications set sync_failed off
```