Webhook verification (optional)

import { webhooks } from '@fluxomail/sdk'

// rawBody: exact request body as a string (do not JSON.parse before verifying)
const ok = webhooks.verifyHmacSignature(rawBody, req.headers, { secret: process.env.FLUXOMAIL_WEBHOOK_SECRET! })
if (!ok) return res.status(401).end('invalid signature')

const out = webhooks.verifyAndParse(rawBody, req.headers, { secret: process.env.FLUXOMAIL_WEBHOOK_SECRET! })
if (!out.ok) return res.status(401).end('invalid signature')
for (const evt of out.events) {
  // handle event (evt.id, evt.type, evt.data)
}

import express from 'express'
import bodyParser from 'body-parser'
import { webhooks } from '@fluxomail/sdk'

const app = express()
app.post('/webhooks/fluxomail', bodyParser.text({ type: '*/*' }), (req, res) => {
  const raw = req.body as string
  const ok = webhooks.verifyHmacSignature(raw, req.headers as any, { secret: process.env.FLUXOMAIL_WEBHOOK_SECRET! })
  if (!ok) return res.status(401).end('invalid signature')
  const out = webhooks.verifyAndParse(raw, req.headers as any, { secret: process.env.FLUXOMAIL_WEBHOOK_SECRET! })
  if (!out.ok) return res.status(401).end('invalid signature')
  // process out.events
  return res.status(200).end('ok')
})

// app/api/fluxomail/webhook/route.ts
import { webhooks } from '@fluxomail/sdk'

export const runtime = 'nodejs'
export async function POST(request: Request) {
  const raw = await request.text()
  const ok = webhooks.verifyHmacSignature(raw, request.headers, { secret: process.env.FLUXOMAIL_WEBHOOK_SECRET! })
  if (!ok) return new Response('invalid signature', { status: 401 })
  const out = webhooks.verifyAndParse(raw, request.headers, { secret: process.env.FLUXOMAIL_WEBHOOK_SECRET! })
  if (!out.ok) return new Response('invalid signature', { status: 401 })
  // process out.events
  return new Response('ok', { status: 200 })
}