Documentation Index
Fetch the complete documentation index at: /docs/llms.txt
Use this file to discover all available pages before exploring further.
Receive real-time delivery events from Torpedo
curl -X POST https://api.torpedo.co.mz/api/v1/webhooks \
-H "X-API-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"url": "https://myapp.com/webhooks/torpedo",
"events": ["email.delivered", "email.bounced", "email.complained", "email.failed"]
}'
signingSecret — save it immediately, it is returned once only.
| Event | When it fires |
|---|---|
email.delivered | AWS SES confirmed delivery to the recipient’s inbox |
email.bounced | Email bounced — hard bounces are suppressed automatically |
email.complained | Recipient marked the email as spam |
email.failed | Delivery failed after retries |
domain.verified | Domain DNS records verified successfully |
domain.failed | Domain verification failed |
{
"event": "email.delivered",
"data": {
"id": "01960000-0000-0000-0000-000000000000",
"workspaceId": "...",
"to": "user@example.com",
"from": "hello@myapp.com",
"subject": "Welcome",
"status": "delivered",
"deliveredAt": "2026-04-15T10:00:00.000Z"
}
}
X-Signature header:
X-Signature: sha256=a3f2c1d8...
import { createHmac, timingSafeEqual } from 'crypto'
function verifySignature(rawBody, signature, secret) {
const expected = 'sha256=' + createHmac('sha256', secret)
.update(rawBody)
.digest('hex')
return timingSafeEqual(Buffer.from(expected), Buffer.from(signature))
}
// Express example
app.post('/webhooks/torpedo', express.raw({ type: 'application/json' }), (req, res) => {
const sig = req.headers['x-signature']
if (!verifySignature(req.body, sig, process.env.TORPEDO_WEBHOOK_SECRET)) {
return res.status(401).send('Invalid signature')
}
const { event, data } = JSON.parse(req.body)
res.status(200).send('ok')
})
import hmac
import hashlib
def verify_signature(raw_body: bytes, signature: str, secret: str) -> bool:
expected = 'sha256=' + hmac.new(
secret.encode(), raw_body, hashlib.sha256
).hexdigest()
return hmac.compare_digest(expected, signature)
package main
import (
"crypto/hmac"
"crypto/sha256"
"encoding/hex"
"fmt"
)
func verifySignature(rawBody []byte, signature, secret string) bool {
mac := hmac.New(sha256.New, []byte(secret))
mac.Write(rawBody)
expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
return hmac.Equal([]byte(expected), []byte(signature))
}
func main() {
ok := verifySignature([]byte(`{"event":"email.delivered",...}`),
"sha256=abc123...", "your_signing_secret")
fmt.Println("valid:", ok)
}
boolean valid = WebhookVerifier.verify(rawBody, signingSecret, signatureHeader);
using System.Security.Cryptography;
using System.Text;
static bool VerifySignature(byte[] rawBody, string signature, string secret)
{
using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
var hash = hmac.ComputeHash(rawBody);
var expected = "sha256=" + Convert.ToHexString(hash).ToLower();
return CryptographicOperations.FixedTimeEquals(
Encoding.UTF8.GetBytes(expected),
Encoding.UTF8.GetBytes(signature)
);
}
timingSafeEqual, hmac.Equal, CryptographicOperations.FixedTimeEquals) to prevent timing
attacks — never use plain string equality.2xx within 5 secondsGET /api/v1/webhooks/{id}/deliveries.