Inbound email for your product.

// Express webhook handler (Standard Webhooks)
import express from 'express'
import crypto from 'crypto'

app.post('/webhook', (req, res) => {
  // Verify Standard Webhooks signature
  const { 'webhook-id': id, 'webhook-timestamp': ts, 'webhook-signature': sigs } = req.headers
  const secret = Buffer.from(process.env.WEBHOOK_SECRET.replace(/^whsec_/, ''), 'base64')
  const expected = crypto.createHmac('sha256', secret)
    .update(`${id}.${ts}.${req.rawBody}`).digest('base64')

  const valid = sigs.split(' ').some(s => s === `v1,${expected}`)
  if (!valid) return res.status(401).end()

  const { message } = req.body
  console.log(`From: ${message.sender.email}`)
  console.log(`Subject: ${message.subject}`)

  res.status(200).json({ received: true })
})

# Flask webhook handler (Standard Webhooks)
import hmac, hashlib, base64
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def handle_webhook():
    # Verify Standard Webhooks signature
    msg_id = request.headers.get('webhook-id')
    ts = request.headers.get('webhook-timestamp')
    sigs = request.headers.get('webhook-signature')
    body = request.get_data(as_text=True)

    secret = base64.b64decode(WEBHOOK_SECRET.removeprefix('whsec_'))
    expected = base64.b64encode(
        hmac.new(secret, f'{msg_id}.{ts}.{body}'.encode(), hashlib.sha256).digest()
    ).decode()

    if not any(s == f'v1,{expected}' for s in sigs.split(' ')):
        return '', 401

    data = request.get_json()
    message = data['message']
    print(f"From: {message['sender']['email']}")
    print(f"Subject: {message['subject']}")

    return jsonify(received=True)

// Laravel webhook controller (Standard Webhooks)
use Illuminate\Http\Request;

class WebhookController extends Controller
{
    public function handle(Request $request)
    {
        // Verify Standard Webhooks signature
        $msgId = $request->header('webhook-id');
        $ts = $request->header('webhook-timestamp');
        $sigs = $request->header('webhook-signature');

        $secret = base64_decode(
            str_replace('whsec_', '', config('services.emailconnect.secret'))
        );
        $signed = "$msgId.$ts." . $request->getContent();
        $expected = base64_encode(hash_hmac('sha256', $signed, $secret, true));

        $valid = collect(explode(' ', $sigs))->contains("v1,$expected");
        if (!$valid) {
            return response('', 401);
        }

        $message = $request->input('message');
        Log::info("From: " . $message['sender']['email']);
        Log::info("Subject: " . $message['subject']);

        return response()->json(['received' => true]);
    }
}

// net/http webhook handler (Standard Webhooks)
func handleWebhook(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    // Verify Standard Webhooks signature
    id, ts := r.Header.Get("webhook-id"), r.Header.Get("webhook-timestamp")
    key := strings.TrimPrefix(os.Getenv("WEBHOOK_SECRET"), "whsec_")
    secret, _ := base64.StdEncoding.DecodeString(key)
    mac := hmac.New(sha256.New, secret)
    mac.Write([]byte(id + "." + ts + "." + string(body)))
    expected := "v1," + base64.StdEncoding.EncodeToString(mac.Sum(nil))
    valid := false
    for _, sig := range strings.Fields(r.Header.Get("webhook-signature")) {
        valid = valid || hmac.Equal([]byte(sig), []byte(expected))
    }
    if !valid {
        w.WriteHeader(http.StatusUnauthorized)
        return
    }
    var p struct { Message struct { Subject string } }
    json.Unmarshal(body, &p)
    log.Printf("Subject: %s", p.Message.Subject)
    w.WriteHeader(http.StatusOK)
}