Webhooks

In the dashboard go to Settings → Webhooks. Add your endpoint URL, pick the event types you want, and save. We will verify reachability with a signed test event.

{
  "event": "delivered",
  "message_id": "msg_8f3a5e21",
  "timestamp": 1715472293,
  "to": "ada@example.com",
  "from": "hello@yourapp.com",
  "category": ["onboarding"],
  "custom_args": {"user_id": "u_42"}
}

Every request includes X-Inbox-Signature (Ed25519, base64) and X-Inbox-Timestamp (Unix seconds). Reject if timestamp is more than 5 minutes old.

import nacl from 'tweetnacl';
function verify(body, sig, ts, publicKey) {
  const msg = Buffer.from(ts + '.' + body);
  return nacl.sign.detached.verify(msg, Buffer.from(sig, 'base64'), publicKey);
}

Non-2xx responses retry with exponential backoff for 24 hours. Each retry includes X-Inbox-Attempt with the count. After 24h we mark the event as failed and surface it in the dashboard.

• processed, deferred, delivered, bounced, dropped
• opened, clicked
• spam_report, unsubscribe, group_unsubscribe, group_resubscribe
• Plus 18 others — see the API reference.