How do I verify a webhook came from Mailhuset?

Each request includes an HMAC signature and a timestamp. Recompute the signature with your signing secret and compare it before you trust the payload.

What happens if my endpoint is down?

We retry with backoff until your endpoint returns a 200, and the delivery log shows every attempt so nothing is lost silently.

Can I choose which events I receive?

Yes. Each endpoint subscribes to the event types you pick, so you only get what you handle.

Webhooks

Signed events, the moment they happen.

Mailhuset tells your systems as soon as a message is delivered, bounced or complained about, or opened and clicked when tracking is on, and signs every payload so you can verify it came from us before you act on it.

Start free Read the docs

POST your-app.com/webhooks

X-Mailhuset-Signature: t=1718...,v1=3ba7...
{
  "type": "email.delivered",
  "id": "msg_a91f2c",
  "to": "user@example.com",
  "at": "2026-08-19T14:02:11Z"
}

HMAC-signed

Verify every payload

Replay-safe

Timestamped signatures

Retried

With backoff until 200

Delivery log

See every attempt

Events you can actually trust

A webhook is only useful if you can trust it and rely on it arriving. Mailhuset signs each one and retries until your endpoint confirms receipt.

Every delivery event

Delivered, bounced, complained, opened, clicked and more are posted to your endpoint as soon as they occur. Opens and clicks need tracking on, which broadcasts have by default.

HMAC signatures

Each payload carries a signature you verify with your key, so a forged request never reaches your business logic.

Retries with backoff

If your endpoint is down, we retry with backoff until you return a 200, so a brief outage does not lose events.

Replay protection

Signatures are timestamped, so a captured request cannot be replayed against your endpoint later.

A delivery log

See each attempt, its response and its timing, so a misbehaving endpoint is easy to spot and debug.

Manage endpoints

Add, pause or rotate endpoints and choose which event types each one receives, all from the dashboard.

Common questions

How do I verify a webhook came from Mailhuset?: Each request includes an HMAC signature and a timestamp. Recompute the signature with your signing secret and compare it before you trust the payload.
What happens if my endpoint is down?: We retry with backoff until your endpoint returns a 200, and the delivery log shows every attempt so nothing is lost silently.
Can I choose which events I receive?: Yes. Each endpoint subscribes to the event types you pick, so you only get what you handle.

Wire your app to every send

Add an endpoint, verify a signature, and start receiving signed delivery events in minutes.

Start free See pricing