Question : How do I verify that a webhook really comes from Mailpro (HMAC signature)?

Every call sent by Mailpro carries headers that let you authenticate it:

X-Mailpro-Signature : t=1758000000,v1=5a72…c8b1
X-Mailpro-Event-Id  : evt_5f2c…
X-Mailpro-Event-Type: email.delivered
X-Mailpro-Attempt   : 1

Computing the signature

v1 is the HMAC-SHA256, in lowercase hexadecimal, of the string t + "." + raw request body, computed with the secret given when the webhook was created. The body must be taken exactly as received, before any JSON decoding.

// Node.js
const crypto = require("crypto");
function verify(rawBody, header, secret) {
const t  = header.match(/t=([0-9]+)/)[1];
const v1 = header.match(/v1=([0-9a-f]+)/)[1];
const expected = crypto.createHmac("sha256", secret).update(t + "." + rawBody).digest("hex");
const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;   // 5 minutes
return fresh && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

Good practice

• Reject any request whose signature does not match, or whose timestamp t is more than a few minutes old (replay protection).
• Use X-Mailpro-Event-Id to ignore an event you have already processed: the same delivery may be presented several times when retried.
• Answer 2xx within 10 seconds, then process the message asynchronously.
• After Rotate the secret, the old secret is invalidated immediately: update your server first, or tolerate a minute of rejected signatures.

Automation webhook targets (direction B) use the same principle, with the X-Mailpro-Automation-Signature header and the optional signing key you define on the target.