Inbound email, parsed and delivered

// Express webhook handler
import express from 'express'
import crypto from 'crypto'

app.post('/webhook', (req, res) => {
  // Verify HMAC signature
  const signature = req.headers['x-emailconnect-signature']
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(JSON.stringify(req.body))
    .digest('hex')

  if (signature !== expected) return res.status(401).end()

  const { message, spam } = req.body
  console.log(`From: ${message.sender.email}`)
  console.log(`Subject: ${message.subject}`)

  res.status(200).json({ received: true })
})

# Flask webhook handler
import hmac, hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def handle_webhook():
    # Verify HMAC signature
    signature = request.headers.get('X-Emailconnect-Signature')
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        request.get_data(),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        return '', 401

    data = request.get_json()
    message = data['message']
    print(f"From: {message['sender']['email']}")
    print(f"Subject: {message['subject']}")

    return jsonify(received=True)

// Laravel webhook controller
use Illuminate\Http\Request;

class WebhookController extends Controller
{
    public function handle(Request $request)
    {
        // Verify HMAC signature
        $signature = $request->header('X-Emailconnect-Signature');
        $expected = hash_hmac(
            'sha256',
            $request->getContent(),
            config('services.emailconnect.secret')
        );

        if (!hash_equals($expected, $signature)) {
            return response('', 401);
        }

        $message = $request->input('message');
        Log::info("From: " . $message['sender']['email']);
        Log::info("Subject: " . $message['subject']);

        return response()->json(['received' => true]);
    }
}