Keep the browser focused on your product and let a Node.js server own the email API credential, event lookup and send reconciliation.
Keep the key on the server
Install the versioned Node SDK or call the documented HTTPS endpoints from a server process. Set the canonical base URL explicitly and pin the dependency version.
Reject configurations that load a production key into client-side JavaScript. Redact authorization headers and full payloads from structured logs.
Preserve the raw callback body
Capture the raw UTF-8 request bytes before JSON parsing, compare the HMAC signature in constant time and then look up the exact event in your database.
Reject stale, unknown or mismatched records. A JSON parser that runs before signature verification can make the signed request unrecoverable.
Use stable retries
Validate the exact template variables, send with a stable idempotency key and store the email ID. If a fetch times out, inspect the original request and delivery history before creating anything new.
A 202 response is queue acceptance. Use signed webhooks and delivery logs to follow later outcomes.
Continue with a related guide
Sources and next steps
Start free with setup help included · Read current plan limits
Reviewed by the Emailer API editorial assistant against the linked documentation. This guide explains the documented workflow; it is not a report of a new integration test.