Resend webhooks

See exactly when an email bounced, opened, or was marked as spam.

Get a test URL

claude mcp add --transport http webhook-studio https://webhook-studio.com/mcp \
  --header "Authorization: Bearer $(curl -s -X POST https://webhook-studio.com/api/start | jq -r .api_token)"

Point Resend at this URL

1. Create a test endpoint below and copy its URL.
2. In the Resend dashboard, open Webhooks → Add Webhook.
3. Paste the Webhook Studio URL and select the events you want (email.delivered, email.bounced are the usual first two).
4. Copy the signing secret — it starts with whsec_.
5. Send yourself a test email through Resend and watch the lifecycle events land in the Inbox.

What a Resend delivery looks like

A representative body, using Resend’s field names. Your own deliveries appear in the Inbox exactly as sent, headers and raw bytes included.

{
  "type": "email.delivered",
  "created_at": "2026-07-21T09:14:02.114Z",
  "data": {
    "email_id": "4ef9a417-02e9-4d39-ad75-9611e0fcc33c",
    "created_at": "2026-07-21T09:13:58.226Z",
    "from": "notifications@example.com",
    "to": [
      "alex@example.com"
    ],
    "subject": "Your receipt from Example",
    "tags": [
      {
        "name": "category",
        "value": "receipt"
      }
    ]
  }
}

Delivery headers

Event types

The events worth handling first. See Resend’s own documentation for the complete list.

Verify the svix-signature header

Resend signs each delivery with HMAC-SHA256 over the raw request body, keyed on your webhook secret. Verify before you parse, and before you act.

import express from 'express';
import crypto from 'crypto';

const app = express();

app.post('/webhooks/resend', express.raw({ type: 'application/json' }), (req, res) => {
  const id = req.get('svix-id');
  const ts = req.get('svix-timestamp');
  const header = req.get('svix-signature') ?? '';

  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.sendStatus(401);

  // whsec_<base64> — decode the part after the prefix to get the key bytes.
  const key = Buffer.from(process.env.RESEND_WEBHOOK_SECRET.split('_')[1], 'base64');
  const expected = crypto
    .createHmac('sha256', key)
    .update(`${id}.${ts}.${req.body}`)
    .digest('base64');

  const ok = header.split(' ').some((part) => {
    const sig = part.startsWith('v1,') ? part.slice(3) : null;
    if (!sig) return false;
    const a = Buffer.from(expected, 'base64');
    const b = Buffer.from(sig, 'base64');
    return a.length === b.length && crypto.timingSafeEqual(a, b);
  });
  if (!ok) return res.sendStatus(401);

  res.sendStatus(200);
  const event = JSON.parse(req.body);
  // if (event.type === 'email.bounced') suppress(event.data.to)
});

Retries and delivery guarantees

Resend delivers through Svix. A non-2xx response is retried at 5 seconds, 5 minutes, 30 minutes, 2 hours, 5 hours and 10 hours, and if every attempt to an endpoint fails across a 5-day window the endpoint is disabled. Delivery is explicitly at-least-once and not ordered — email.delivered can arrive before the email.sent it follows — so deduplicate on svix-id and sort by the payload's own created_at when sequence matters.

Common pitfalls

FAQ