Receive leads

curl -X POST https://app.getmailr.com/api/v1/webhooks/subscribe \
  -H "Authorization: Bearer $MAILR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "target_url": "https://hooks.example.com/mailr/leads" }'

const res = await fetch("https://app.getmailr.com/api/v1/webhooks/subscribe", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.MAILR_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ target_url: "https://hooks.example.com/mailr/leads" }),
});

if (!res.ok) throw new Error(`Mailr API returned ${res.status}`);
const { id, signing_secret } = await res.json();
console.log(id, signing_secret); // store signing_secret — deliveries are HMAC-signed with it

import os
import requests

res = requests.post(
    "https://app.getmailr.com/api/v1/webhooks/subscribe",
    headers={"Authorization": "Bearer " + os.environ["MAILR_API_KEY"]},
    json={"target_url": "https://hooks.example.com/mailr/leads"},
)

res.raise_for_status()
print(res.json())  # store signing_secret — deliveries are HMAC-signed with it

<?php
$payload = ["target_url" => "https://hooks.example.com/mailr/leads"];

$ch = curl_init("https://app.getmailr.com/api/v1/webhooks/subscribe");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer " . getenv("MAILR_API_KEY"),
    "Content-Type: application/json",
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));

$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($status !== 200) {
    throw new RuntimeException("Mailr API returned $status: $body");
}
print_r(json_decode($body, true)); // store signing_secret — deliveries are HMAC-signed with it

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;

// `rawBody` MUST be the exact string received, not JSON.parse'd and re-stringified.
export function verifyMailrSignature(secret, rawBody, headers) {
  const ts = headers["x-mailr-timestamp"];
  const sig = headers["x-mailr-signature"];
  if (!/^\d{1,15}$/.test(String(ts ?? ""))) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(ts)) > TOLERANCE_SECONDS) return false;

  const expected = "sha256=" +
    createHmac("sha256", secret).update(`${ts}.${rawBody}`, "utf8").digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(String(sig ?? "").toLowerCase());
  return a.length === b.length && timingSafeEqual(a, b);
}

import hmac, hashlib, time

TOLERANCE_SECONDS = 300

def verify_mailr_signature(secret: str, raw_body: bytes, headers: dict) -> bool:
    ts = headers.get("X-Mailr-Timestamp", "")
    sig = headers.get("X-Mailr-Signature", "").lower()
    if not (ts.isascii() and ts.isdigit()):
        return False
    if abs(int(time.time()) - int(ts)) > TOLERANCE_SECONDS:
        return False
    signed = f"{ts}.".encode() + raw_body
    expected = "sha256=" + hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

<?php
const TOLERANCE_SECONDS = 300;

// $rawBody = file_get_contents("php://input");  // exact bytes — never re-encode the parsed JSON
// $ts = $_SERVER["HTTP_X_MAILR_TIMESTAMP"] ?? ""; $sig = $_SERVER["HTTP_X_MAILR_SIGNATURE"] ?? "";
function verify_mailr_signature(string $secret, string $rawBody, string $ts, string $sig): bool
{
    if (!ctype_digit($ts)) {
        return false;
    }
    if (abs(time() - (int) $ts) > TOLERANCE_SECONDS) {
        return false;
    }

    $expected = "sha256=" . hash_hmac("sha256", $ts . "." . $rawBody, $secret);
    return hash_equals($expected, strtolower($sig));
}