Email to webhook, on your own domain

{
  "event": "email.received",
  "webhookId": "wh_...",
  "timestamp": "2026-10-17T09:30:00.000Z",
  "data": {
    "id": "em_...",
    "mailbox": "orders@acme.com",
    "folder": "inbox",
    "direction": "incoming",
    "from": { "name": "Dana Lee", "address": "dana@example.com" },
    "to": [{ "name": null, "address": "orders@acme.com" }],
    "cc": [], "replyTo": [],
    "subject": "PO 4471 attached",
    "snippet": "Hi, please find the purchase order…",
    "text": "Hi, please find the purchase order attached.",
    "html": "<p>Hi, please find the purchase order attached.</p>",
    "headers": { "message-id": "<…@example.com>", "...": "..." },
    "messageId": "<…@example.com>",
    "inReplyTo": null,
    "references": [],
    "threadId": "th_...",
    "receivedAt": "2026-10-17T09:29:58.000Z",
    "attachments": [
      { "id": "att_...", "fileName": "PO-4471.pdf", "contentType": "application/pdf", "size": 48213, "disposition": "attachment" }
    ]
  }
}

// A Cloudflare Worker (or any fetch handler) that receives MarkRelay's
// email.received event and checks its signature before trusting it.
export default {
  async fetch(request: Request, env: { MARKRELAY_WEBHOOK_SECRET: string }) {
    const body = await request.text(); // the exact raw body
    const timestamp = request.headers.get("X-MarkRelay-Timestamp") ?? "";
    const signature = (request.headers.get("X-MarkRelay-Signature") ?? "").replace(/^sha256=/, "");

    const key = await crypto.subtle.importKey(
      "raw",
      new TextEncoder().encode(env.MARKRELAY_WEBHOOK_SECRET), // whsec_...
      { name: "HMAC", hash: "SHA-256" },
      false,
      ["verify"],
    );
    const bytes = new Uint8Array((signature.match(/../g) ?? []).map((hex) => parseInt(hex, 16)));
    const valid = await crypto.subtle.verify("HMAC", key, bytes, new TextEncoder().encode(`${timestamp}.${body}`));
    if (!valid) return new Response("invalid signature", { status: 401 });

    const { event, data } = JSON.parse(body);
    // data: { id, mailbox, from, to, cc, subject, text, html, headers, attachments, ... }
    console.log(event, data.mailbox, data.from.address, data.subject);
    return new Response("ok"); // any 2xx counts as delivered
  },
};