Webhooks

import { UseSend } from "usesend-js";
import express from "express";

const usesend = new UseSend(
  process.env.USESEND_API_KEY!, // us_xxx
  "https://mail.everjust.app/api/v1"
);

const app = express();

// Capture the RAW body — do not use express.json() on this route.
app.post(
  "/webhooks/usesend",
  express.raw({ type: "application/json" }),
  (req, res) => {
    try {
      const event = usesend
        .webhooks(process.env.USESEND_WEBHOOK_SECRET!) // whsec_xxx
        .constructEvent(req.body, { headers: req.headers });

      // Signature + timestamp verified. Ack fast, process async.
      res.status(200).send("ok");

      switch (event.type) {
        case "email.bounced":
          console.log("bounce", event.data.emailId, event.data.bounce);
          break;
        case "email.opened":
          console.log("open", event.data.emailId, event.data.open);
          break;
        // …handle other types
      }
    } catch (err) {
      // Invalid signature or stale timestamp.
      res.status(400).send("invalid signature");
    }
  }
);

from usesend import UseSend
from flask import Flask, request

usesend = UseSend(
    "us_xxx",
    "https://mail.everjust.app/api/v1",
)

app = Flask(__name__)


@app.post("/webhooks/usesend")
def usesend_webhook():
    # request.get_data() returns the RAW body bytes.
    raw_body = request.get_data()
    try:
        event = usesend.webhooks("whsec_xxx").construct_event(
            raw_body,
            headers=dict(request.headers),
        )
    except Exception:
        return "invalid signature", 400

    if event["type"] == "email.bounced":
        print("bounce", event["data"]["emailId"], event["data"]["bounce"])
    elif event["type"] == "email.opened":
        print("open", event["data"]["emailId"], event["data"]["open"])

    return "ok", 200

# Given the incoming request:
TIMESTAMP="1756737130221"          # X-UseSend-Timestamp (ms)
RAW_BODY='{"id":"evt_9f2c1a7b","type":"email.delivered",...}'  # exact bytes
SECRET="whsec_xxx"

# Signed string is "{timestamp}.{rawBody}"
SIGNED="${TIMESTAMP}.${RAW_BODY}"

# Compute HMAC-SHA256, hex-encoded:
printf '%s' "$SIGNED" | \
  openssl dgst -sha256 -hmac "$SECRET" -r | awk '{print "v1="$1}'

# Compare the output against the X-UseSend-Signature header
# using a constant-time comparison, and reject if the
# X-UseSend-Timestamp is more than 5 minutes old.

{
  "type": "email.bounced",
  "data": {
    "emailId": "clx8s0f7e0000abcd1234wxyz",
    "status": "BOUNCED",
    "bounce": {
      "type": "Permanent",
      "subType": "General",
      "message": "The email account that you tried to reach does not exist."
    }
  }
}

{
  "type": "email.opened",
  "data": {
    "emailId": "clx8s0f7e0000abcd1234wxyz",
    "status": "OPENED",
    "open": {
      "timestamp": "2026-09-01T14:40:02.100Z",
      "userAgent": "Mozilla/5.0 …",
      "ip": "203.0.113.10"
    }
  }
}

{
  "type": "email.clicked",
  "data": {
    "emailId": "clx8s0f7e0000abcd1234wxyz",
    "status": "CLICKED",
    "click": {
      "timestamp": "2026-09-01T14:41:18.502Z",
      "url": "https://everjust.app/welcome"
    }
  }
}

{
  "type": "email.suppressed",
  "data": {
    "emailId": "clx8s0f7e0000abcd1234wxyz",
    "status": "SUPPRESSED",
    "suppression": {
      "type": "Bounce",
      "reason": "Previous hard bounce for this recipient",
      "source": "AUTO"
    }
  }
}