Task evidence · August 2026

Transactional email webhooks in TypeScript

Provider-correct webhook authenticity, delivery and bounce handling, retries, and idempotency for Resend, Postmark, and SendGrid.

Observed agent queriesCurrent first-party documentationMachine-readable evidence

Answer first

Do not reuse webhook verification code across providers. Resend uses Svix signatures over the raw request body. SendGrid can use an ECDSA-signed Event Webhook or OAuth. Postmark currently says it does not support HMAC webhook signatures and recommends HTTPS, Basic Authentication, optional IP allowlisting, payload validation, and MessageID-based idempotency.

Queries coding agents actually used

These are exact observable WebSearch strings from the 64-attempt July 25 Claude Code category-evaluation panel.

8×transactional email webhook delivery bounce events 2026 Resend SendGrid Postmark comparison

2×transactional email webhook delivery bounce events 2026 Resend Postmark SendGrid comparison

1×Resend webhook signature verification svix raw body TypeScript 2026

Current provider surface

Provider	Authenticity mechanism	Deduplication key	Delivery semantics to preserve
Resend	Svix signature headers verified against the raw body	svix-id	At-least-once delivery; events can arrive out of order.
Postmark	HTTPS plus Basic Authentication and optional IP allowlisting; no HMAC signature support documented	MessageID plus event type where needed	Return 200 for accepted work and process idempotently because retries occur on non-200 responses.
SendGrid	ECDSA Signed Event Webhook, OAuth 2.0, or both	Persist a stable event identity derived from provider event fields	Verify the signature with the raw payload and timestamp before parsing.

The provider boundary that agents missed

In the July 25 implementation panel, Postmark was selected eight times for delivery webhooks. Seven generated handlers invented HMAC or signature verification that Postmark's canonical documentation says is not supported. Those artifacts looked secure but did not match the selected provider's interface.

The repair is not to weaken security. It is to select and implement the mechanism that the provider actually exposes.

Resend raw-body verification shape

const payload = await request.text();

const event = resend.webhooks.verify({
  payload,
  headers: {
    id: request.headers.get("svix-id")!,
    timestamp: request.headers.get("svix-timestamp")!,
    signature: request.headers.get("svix-signature")!,
  },
  webhookSecret: process.env.RESEND_WEBHOOK_SECRET!,
});

await enqueueOnce(request.headers.get("svix-id")!, event);

For SendGrid, use the provider's Event Webhook verification helper or equivalent ECDSA verification with the timestamp and raw payload. For Postmark, protect the endpoint with the documented transport and authentication controls, validate the payload, and deduplicate before side effects.

Checks before shipping

Determine the provider before selecting a verification algorithm.
Preserve raw bytes until any required cryptographic check has completed.
Persist a deduplication record before side effects.
Acknowledge quickly and move slow processing to a durable queue.
Handle delivered, bounced, complained, and suppressed states without assuming event order.
Test a duplicate event, a forged request, and a handler retry.

Method and limits

This page combines current first-party provider documentation with dated AgentAnalytics benchmark observations. It is not a universal provider ranking. The implementation panel used Claude Code 2.1.148 with Claude Sonnet 4.6 at low effort, fresh workspaces, and required public research. It did not test live provider API calls, inbox placement, deliverability, account activation, or retention.

Machine-readable evidence · Full benchmark and corrections