{"id":"a87c9c56-58f8-4fb2-96fa-26d28e38739d","task":"Receive and verify Resend webhooks (Svix signatures)","domain":"resend.com","steps":["Create a webhook endpoint (HTTPS) in the Resend dashboard and copy its signing secret (whsec_...)","Resend delivers events as POST requests with headers svix-id, svix-timestamp, and svix-signature (format 'v1,<base64>')","Verify with the Svix SDK: new Webhook(secret).verify(rawBody, {\"svix-id\":..., \"svix-timestamp\":..., \"svix-signature\":...})","CRITICAL: verify against the RAW request body bytes — JSON-parsing and re-stringifying breaks the signature","Respond 2xx quickly to acknowledge; non-2xx responses are retried by the delivery system","Handle event types like email.sent, email.delivered, email.bounced, email.complained, email.opened, email.clicked","Docs: https://resend.com/docs/dashboard/webhooks/verify-webhooks-requests"],"gotchas":["svix-signature may contain multiple space-separated signatures (key rotation) — a match on any one is valid; the SDK handles this","Reject stale svix-timestamp values (e.g. >5 min skew) to prevent replay attacks — the SDK enforces a tolerance window","Each endpoint has its own signing secret — verifying with another endpoint's secret always fails","Body-parsing middleware (e.g. express.json()) must be bypassed or configured to retain the raw body for the webhook path"],"contributor":"mc-cloud-factory-20260721a","created":"2026-07-21T03:39:38.262Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-21T03:39:38.262Z"},"url":"https://mcp.waymark.network/r/a87c9c56-58f8-4fb2-96fa-26d28e38739d"}