Webhooks
Real-time, HMAC-signed notifications for every email event. Deliveries, bounces, opens, clicks, and complaints streamed to your endpoint with automatic retries.
Every email event, in real time
Subscribe to delivered, bounced, opened, clicked, and complained events at the account or domain level. Events land at your endpoint within seconds.
HMAC-SHA256 signed payloads
Every request is signed with a rotating secret so your endpoint can verify authenticity in a few lines of code. Replay protection is built in.
Retries and a replay tool
Failed deliveries retry with exponential backoff for up to 24 hours. Inspect the full delivery log and replay any event from the dashboard.
Verify a webhook
import crypto from 'crypto';
function verifyWebhook(payload: string, signature: string, secret: string) {
const expected = crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected),
);
}Use cases
Sync deliverability data into your warehouse
Stream every delivered, bounced, opened, clicked, and complained event into BigQuery, Snowflake, ClickHouse, or Postgres. Build cohort retention curves, content-performance dashboards, and ISP-level deliverability reports natively in your BI tool.
Update CRMs and CDPs in real time
Push email engagement signals into HubSpot, Salesforce, Customer.io, Segment, or Rudderstack. Your sales team sees "Alice opened the proposal" within seconds, not the next-day batch sync.
Trigger downstream automation
On `email.bounced` (hard bounce) automatically deactivate the user account; on `email.complained` open a support ticket; on `email.opened` advance a Customer Success playbook stage. Webhooks are the glue.
Build custom dashboards and alerts
Pipe events into Grafana, Datadog, or your own monitoring tool. Alert on sudden bounce-rate spikes, complaint thresholds, or unusual sending patterns before reputation damage starts.
How it works
Webhooks are HTTP POST requests delivered to a URL you control whenever an email event occurs. PostStack supports eight event types: `email.queued`, `email.sent`, `email.delivered`, `email.bounced`, `email.opened`, `email.clicked`, `email.complained`, and `email.unsubscribed`. Subscribe at the account level (all domains) or domain level (filtered), and pick the exact event types you care about per endpoint. Every request is signed with HMAC-SHA256 using a per-endpoint secret you rotate from the dashboard. The signature is sent in the `X-PostStack-Signature` header and includes a timestamp to prevent replay attacks; reject any request more than five minutes old. Payloads include the full email context — message ID, recipient, subject, tags, custom metadata — plus event-specific fields (bounce reason, click URL, user agent, IP). Delivery has exponential backoff: 1s, 5s, 30s, 2m, 10m, 1h, 6h, 24h. Failures expire after 24 hours of attempts. Endpoints that return non-2xx for 20 consecutive deliveries are auto-disabled and emit an alert so you find out quickly. The dashboard shows full delivery history per endpoint with replay buttons for any individual event or batch — useful when you ship a bug, fix it, and want to re-process the events you missed. Outbound IPs are documented and stable so you can allowlist them in your firewall.
Frequently asked questions
How do I verify a webhook is from PostStack?
Every request is signed with HMAC-SHA256 over `timestamp + "." + body`, using a per-endpoint secret you set in the dashboard. The signature is sent in `X-PostStack-Signature`. Compute the expected signature and use a constant-time comparison; reject mismatches.
What event types are supported?
email.queued, email.sent, email.delivered, email.bounced (with hard/soft classification), email.opened, email.clicked, email.complained, and email.unsubscribed. Webhook subscriptions can filter to any subset of these.
What happens if my endpoint is down?
PostStack retries with exponential backoff (1s, 5s, 30s, 2m, 10m, 1h, 6h, 24h). After 20 consecutive failures the endpoint is auto-disabled and you get a dashboard alert. You can re-enable and replay missed events from the dashboard.
Can I replay events?
Yes. Every delivery is logged with the request, response, and status. Replay any single delivery or a batch by date range with one click. Useful for catching up after deploying a fix.
Are there source IPs to allowlist?
Yes — PostStack webhook deliveries come from a small, documented set of EU IPs. Allowlist them in your firewall if your endpoint is locked down.