Receive transactional email events

• email.delivered
• email.bounced
• email.complained

Eza-Signature: t=<timestamp>,v1=<signature>

Calculate HMAC-SHA256 using the timestamp, a period and the raw request body. Compare it with the signature using the endpoint signing secret. Reject timestamps older than 5 minutes.

import { createHmac, timingSafeEqual } from 'node:crypto' export function verify(header, rawBody, secret) {  const parts = Object.fromEntries(    header.split(',').map((part) => part.split('='))  )  const age = Date.now() / 1000 - Number(parts.t)  if (age > 300) return false   const expected = createHmac('sha256', secret)    .update(`${parts.t}.${rawBody}`)    .digest('hex')  const given = Buffer.from(parts.v1 ?? '')  return given.length === expected.length &&    timingSafeEqual(given, Buffer.from(expected))}

Pending engineering: confirm the signature encoding (hex) and timestamp unit (seconds) against the implementation.

If your endpoint does not return a 2xx response, Eza retries after:

1. 1About 10 seconds
2. 21 minute
3. 35 minutes
4. 430 minutes
5. 52 hours
6. 66 hours
7. 712 hours

Retries stop after 24 hours.

Failed events remain available for replay in the dashboard for 30 days.