Verify AgentMail incoming events before agent processing

Create a webhook for the intended inbox/scope and select incoming-message events. AgentMail uses Svix to sign deliveries; a MailKite signature verifier or SendHog-specific event parser is not a substitute.

Verify with the supported delivery library

Install svix and preserve the HTTP body’s exact original bytes before JSON middleware. This is a verification excerpt, not an HTTP server or complete persistence implementation:

import { Webhook } from "svix";
const event = new Webhook(signingSecret).verify(rawBody, {
  "svix-id": svixId,
  "svix-timestamp": svixTimestamp,
  "svix-signature": svixSignature,
});
// Inputs come from the original request and this endpoint's secret.
// Reject verification errors before trusting event or invoking the model.

Follow AgentMail’s verification guide for exact headers, endpoint secret handling, and timestamp tolerance. Never log the signing secret. Correct clock drift or raw-body handling instead of disabling replay checks to get a sample through.

Deduplicate across subscription levels

AgentMail documents that svix-id is stable for retries to one webhook but can differ between organization-, pod-, and inbox-level deliveries. Use the authenticated payload’s event_id to deduplicate the same logical event across those subscriptions, and namespace records by your provider/account context.

1. Validate the verified event type and inbox identity against the configured tenant.
2. For message.received, persist the accepted event/job before acknowledgement.
3. Fetch required message content with the least-privilege SDK client if the notification does not contain everything needed.
4. Keep provider delivery/security events in separate handlers rather than treating every callback as a new email.

Do not assume every spam, blocked, or unauthenticated event is visible to every key. Label-visibility permissions affect both reading and relevant event subscriptions.

Verify the agent boundary too

Test a bad signature, duplicate event across two subscription scopes, temporary storage failure, unexpected inbox, and a hostile body using fixtures. Limit attachments, avoid active HTML/link fetching, and pass content as untrusted data. A verified delivery does not authorize tool use, disclosure, or sending a reply; the next guide handles draft review.