Webhooks

Verify Signatures

Each webhook request is signed with the signing secret of its endpoint, in the Standard Webhooks format. Check the signature before you trust the body.

Request

import { verifyWebhook } from 'inboxjot';

export async function POST(request) {
  const event = await verifyWebhook({
    payload: await request.text(),
    headers: request.headers,
    secret: process.env.INBOXJOT_WEBHOOK_SECRET,
  });

  if (event.type === 'email.bounced') {
    console.log(event.data.email_id, event.data.bounce.type);
  }

  return new Response(null, { status: 204 });
}

Headers

webhook-idstring

The event id. Use it to ignore a delivery you already handled.

webhook-timestampinteger

Unix time in seconds when Inboxjot signed the request.

webhook-signaturestring

One or more signatures as v1,<base64>, separated by spaces.

How to Verify

Remove the whsec_ prefix from the secret and decode the rest from base64. Sign {webhook-id}.{webhook-timestamp}.{body} with HMAC-SHA256 and that key, then encode the result in base64.

The request is valid when one signature in the header matches. Use the raw body as you received it, and refuse a timestamp that is more than 5 minutes old.

import { verifyWebhook } from 'inboxjot'; export async function POST(request) { const event = await verifyWebhook({ payload: await request.text(), headers: request.headers, secret: process.env.INBOXJOT_WEBHOOK_SECRET, }); if (event.type === 'email.bounced') { console.log(event.data.email_id, event.data.bounce.type); } return new Response(null, { status: 204 }); }