Bounce/complaint webhooks for SendGrid, Mailgun and Postmark #73

New issue

Open

opened 2026-10-26 10:46:04 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-26 10:46:04 -04:00

Owner

Follow-up to #49 (Phase 13.1, v0.15.1).

#49 asked for bounce and complaint webhooks for each API provider, following the SES/SNS design: signature checks and an allowlist, with results going into the same message, contact and event records.

Plan

Public webhook endpoints per provider:
- SendGrid Event Webhook (signed, ECDSA public key verification)
- Mailgun webhooks (HMAC-SHA256 with webhook signing key, timestamp/token replay check)
- Postmark bounce/spam-complaint webhooks (basic auth / secret + source allowlist)
Reject bad signatures; map hard bounces and complaints to the same suppression/event handling as SES.
Webhook secrets are write-only in sender settings; setup documented.
Plain HTTPS / node crypto, no large SDKs; pin any new versions.

Done when

Tests for each provider: valid signed payload records bounce/complaint; bad signature is rejected.

Follow-up to #49 (Phase 13.1, v0.15.1). #49 asked for bounce and complaint webhooks for each API provider, following the SES/SNS design: signature checks and an allowlist, with results going into the same message, contact and event records. **Plan** - Public webhook endpoints per provider: - SendGrid Event Webhook (signed, ECDSA public key verification) - Mailgun webhooks (HMAC-SHA256 with webhook signing key, timestamp/token replay check) - Postmark bounce/spam-complaint webhooks (basic auth / secret + source allowlist) - Reject bad signatures; map hard bounces and complaints to the same suppression/event handling as SES. - Webhook secrets are write-only in sender settings; setup documented. - Plain HTTPS / node crypto, no large SDKs; pin any new versions. **Done when** - Tests for each provider: valid signed payload records bounce/complaint; bad signature is rejected.

vmanne-poc added this to the Phase 13.1: API key scopes & provider webhooks milestone

2026-10-26 10:46:04 -04:00

vmanne-poc added the

feature

security

labels

2026-10-26 10:46:04 -04:00

vmanne-poc referenced this issue

2026-10-26 10:46:14 -04:00

API-based sending providers (SendGrid, Mailgun, Postmark, SES API) #49