Email API

curl -X POST https://api.mailghor.com/v1/emails \
  -H "Authorization: Bearer $EMAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1234" \
  -d '{
    "from": "Acme <[email protected]>",
    "to": ["[email protected]"],
    "subject": "Your order is on its way",
    "html": "<p>Thanks for shopping with us.</p>",
    "tags": [{ "name": "category", "value": "order" }]
  }'

const res = await fetch("https://api.mailghor.com/v1/emails", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.EMAIL_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    from: "Acme <[email protected]>",
    to: "[email protected]",
    subject: "Your sign-in code",
    text: "Your code is 482913",
  }),
});
const { id } = await res.json();

curl -X POST https://api.mailghor.com/v1/emails/batch \
  -H "Authorization: Bearer $EMAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "emails": [
    { "from": "[email protected]", "to": "[email protected]", "subject": "Hi A", "text": "…" },
    { "from": "[email protected]", "to": "[email protected]", "subject": "Hi B", "text": "…" }
  ] }'

# → { "data": [{ "id": "…" }, { "id": "…" }] }

curl https://api.mailghor.com/v1/emails/4f1c2d8e-… \
  -H "Authorization: Bearer $EMAIL_API_KEY"

# Cancel a scheduled email:
curl -X POST https://api.mailghor.com/v1/emails/4f1c2d8e-…/cancel \
  -H "Authorization: Bearer $EMAIL_API_KEY"

Host:      smtp.mailghor.com
Port:      587 (STARTTLS) or 465 (TLS)
Username:  shown under Email API › SMTP
Password:  one of your API keys

{
  "type": "email.delivered",
  "created_at": "2026-11-14T09:51:20.000Z",
  "data": {
    "email_id": "4f1c2d8e-…",
    "from": "Acme <[email protected]>",
    "to": ["[email protected]"],
    "subject": "Your order is on its way",
    "recipients": ["[email protected]"],
    "tags": { "category": "order" }
  }
}

import crypto from "node:crypto";

// secret: the whsec_… value from the panel. body: the raw request body (a string).
export function verify(secret, headers, body) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false; // older than 5 minutes
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = crypto.createHmac("sha256", key).update(`${id}.${timestamp}.${body}`).digest("base64");
  return headers["webhook-signature"].split(" ").some((part) => part === `v1,${expected}`);
}