Receive MailKite email as signed JSON

Create an exact-address route on your verified receiving domain and point it to a public HTTPS handler. Keep the route’s signing secret distinct from the sending API key. A domain-level test does not necessarily prove the exact address route works.

Authenticate before processing

Use a language-specific receiver rather than implementing your own HMAC scheme. In Node.js the existing SDK verifies the original bytes:

import { MailKite } from "mailkite";
// signature: x-mailkite-signature; rawBody: original request Buffer.
const valid = MailKite.verifyWebhook(signature, rawBody, signingSecret);
if (!valid) throw new Error("Invalid webhook signature");

This is a handler excerpt, not a complete HTTP server. Mount raw-body handling before JSON middleware. Reject failed verification before reading instructions, fetching attachments, or invoking an agent.

Make acknowledgement recoverable

Store the accepted event or enqueue durable work before returning a successful HTTP response. Deduplicate using the event/message identity, and make downstream effects independently idempotent. Returning 200 before persistence can lose mail if the process crashes.

Send a controlled message to the configured address. Confirm the route, signature verification, stored work, duplicate delivery, and a temporary receiver failure. Treat sender-authentication metadata as evidence about mail, not authorization to perform sensitive actions.

Review webhook security, delivery and retries, and retention before production. Do not feed another provider’s event into this verifier and expect a MailKite signature to exist.