How to Set Up Brevo Free SMTP for Transactional Emails (Step-by-Step)

Brevo (formerly Sendinblue) is an email platform with a free tier: 300 emails/day, no expiration, full access to its SMTP relay. This walks through creating an account, getting SMTP credentials, and wiring them into include/mail_config.php for the forgot-password OTP emails — plus the couple of steps that most people miss and end up stuck on.

1. Create your account

1. Go to https://www.brevo.com and sign up (no card required for the free plan).
2. Verify your email address — Brevo sends a confirmation link before you can do much else.
3. You'll land on the main dashboard once verified.

2. Add and verify a sender

Brevo won't let you send as an address it hasn't confirmed belongs to you — this is the single most common reason "it says sent but nothing arrives."

1. Go to Settings → Senders, Domains & Dedicated IPs → Senders.
2. Click Add a sender, enter the email you want OTPs to come from (e.g. no-reply@ebidou.sch.ng) and a display name (e.g. Ebidou Comprehensive Academy).
3. Brevo emails that address a confirmation link. Click it from an inbox you actually control for that address.
4. Once confirmed, the sender shows a green "verified" status.

If you don't own a domain mailbox yet: you can verify a Gmail/Outlook address you own as a stand-in sender while testing, then switch to your real school domain later.

Domain authentication (do this before going live)

Since 2024, Gmail and Yahoo (and Microsoft since 2025) require sending domains to be authenticated. If you skip this, Brevo silently reroutes your mail to go out from yourname@xxxxxxx.brevosend.com instead of your real address — everything still "sends successfully," it just looks wrong and deliverability suffers.

1. Go to Settings → Senders, Domains & Dedicated IPs → Domains.
2. Add your domain (e.g. ebidou.sch.ng).
3. Brevo gives you a DKIM record (TXT or CNAME) to add in your domain's DNS settings (wherever you manage ebidou.sch.ng's DNS — your registrar or hosting panel).
4. Add the record, then click Verify in Brevo. DNS changes can take anywhere from a few minutes to a few hours to propagate.

You can send mail before doing this, but for a real school rollout (not just testing), do it before relying on it.

3. Get your SMTP credentials

This is the part that trips people up: your SMTP password is a separate "SMTP key," not your Brevo account login password.

1. Go to Settings → SMTP & API (left-hand menu).
2. Click the SMTP tab.
3. You'll see:
   • SMTP Server: smtp-relay.brevo.com
   • Port: 587
   • Login: an address like xxxxxxxxx@smtp-brevo.com — this is your SMTP username, not your real email.
4. Under SMTP keys, click Generate a new SMTP key, give it a name (e.g. "school-portal"), and click Generate.
5. Copy the key immediately — Brevo shows it once. If you navigate away without copying it, you'll need to generate a new one (the old value can't be revealed again, though existing keys can be re-viewed via the eye icon next to them in the table).

4. Plug the credentials into this project

Open include/mail_config.php and fill in:

php

return [
    'host'       => 'smtp-relay.brevo.com',
    'port'       => 587,
    'encryption' => 'tls',
    'username'   => 'xxxxxxxxx@smtp-brevo.com', // the Login from step 3
    'password'   => 'xxxxxxxxxxxxxxxx',          // the SMTP key from step 3
    'from_email' => 'no-reply@ebidou.sch.ng',    // must be a VERIFIED sender from step 2
    'from_name'  => 'Ebidou Comprehensive Academy',
];

from_email must match a sender you verified in step 2 — if it doesn't, Brevo will reject or reroute the send.

5. Send a test and check the logs

Don't just trust the "sent" response from your app,Brevo's own logs tell you what actually happened after your server handed the email off.

1. Trigger a password reset in forgot-password.php to send yourself a test OTP.
2. In Brevo, go to Transactional → Logs (or Statistics → Transactional on some plans).
3. Find your test send. It'll show one of:
   • Delivered — arrived, check spam too.
   • Blocked — usually an unverified sender or a suppressed/bounced address.
   • Soft bounce / Hard bounce — the receiving mail server rejected it.
   • Invalid — malformed recipient address.

This is the fastest way to debug "no email arrived" without guessing.

6. Know the free-plan limits

• 300 emails/day, resets daily — plenty for OTPs at school scale, but you'll hit it if you blast a whole staff list at once for something else.
• Sending speed is capped on the free tier (not instant bulk sending) — fine for one-at-a-time OTPs, not for mass mailouts.
• No dedicated IP on the free plan — you share Brevo's reputation pool, which is normally fine unless another Brevo user on the same shared IP misbehaves and gets it blacklisted. Rare, but worth knowing if deliverability suddenly drops.

7. Around the rest of Brevo (optional, not needed for OTPs)

Brevo is also a full marketing/CRM platform. You won't need any of this for the password-reset flow, but worth knowing it's there if the school ever wants it:

• Contacts — import/manage mailing lists (e.g. parents, alumni).
• Campaigns — newsletter-style bulk email with a drag-and-drop editor.
• Automation — trigger sequences (e.g. "send a welcome email when a new contact is added").
• WhatsApp/SMS — paid add-ons, separate from the free email tier.

None of that is required for sendOtpEmail() — it only uses the SMTP relay from step 3.

Quick troubleshooting checklist

Symptom	Likely cause
API says "sent" but nothing arrives	Sender not verified (step 2), or check Brevo's Logs (step 5)
Landing in spam	Domain not authenticated yet (step 2, DKIM)
"Authentication failed" from PHPMailer	Used your Brevo login password instead of the SMTP key (step 3)
Emails suddenly stop sending	Hit the 300/day free-tier cap, or an SMTP key was regenerated/revoked