Webhooks
Signed events, the moment they happen.
Mailhuset tells your systems as soon as a message is delivered, opened, bounced or complained, and signs every payload so you can verify it came from us before you act on it.
X-Mailhuset-Signature: t=1718...,v1=3ba7...
{
"type": "email.delivered",
"id": "msg_a91f2c",
"to": "user@example.com",
"at": "2026-08-19T14:02:11Z"
}Events you can actually trust
A webhook is only useful if you can trust it and rely on it arriving. Mailhuset signs each one and retries until your endpoint confirms receipt.
Every delivery event
Delivered, opened, bounced, complained and more are posted to your endpoint as soon as they occur.
HMAC signatures
Each payload carries a signature you verify with your key, so a forged request never reaches your business logic.
Retries with backoff
If your endpoint is down, we retry with backoff until you return a 200, so a brief outage does not lose events.
Replay protection
Signatures are timestamped, so a captured request cannot be replayed against your endpoint later.
A delivery log
See each attempt, its response and its timing, so a misbehaving endpoint is easy to spot and debug.
Manage endpoints
Add, pause or rotate endpoints and choose which event types each one receives, all from the dashboard.
Common questions
- How do I verify a webhook came from Mailhuset?
- Each request includes an HMAC signature and a timestamp. Recompute the signature with your signing secret and compare it before you trust the payload.
- What happens if my endpoint is down?
- We retry with backoff until your endpoint returns a 200, and the delivery log shows every attempt so nothing is lost silently.
- Can I choose which events I receive?
- Yes. Each endpoint subscribes to the event types you pick, so you only get what you handle.
Wire your app to every send
Add an endpoint, verify a signature, and start receiving signed delivery events in minutes.