Security

All connections to api.sendexa.co must use HTTPS. The API rejects plain HTTP with a 301 Moved Permanently redirect — never rely on the redirect; always use HTTPS from the start.

Sendexa uses HTTP Basic Auth. Requests must include an Authorization header with a Base64-encoded apiKey:apiSecret token.

# Compute the token once:
echo -n "your_api_key:your_api_secret" | base64

# Use in every request:
Authorization: Basic <base64_token>

You can generate a new API key from the Dashboard at any time without downtime by using a brief overlap window.

1. Go to Dashboard → Settings → API Keys.
2. Click Generate New Key. The old key remains active.
3. Update all services and environment variables to use the new key.
4. Once all deployments are using the new key, click Revoke Old Key.

Every webhook Sendexa delivers is signed with HMAC-SHA256 using your webhook secret. Always verify the signature before processing the event — this prevents attackers from sending fake payloads to your endpoint.

import { createHmac, timingSafeEqual } from "crypto";

function verifyWebhook(
  signature: string,   // X-Sendexa-Signature header value
  rawBody:   Buffer,   // raw, unparsed request body
  secret:    string,   // your webhook secret from the dashboard
): boolean {
  const sig = signature.startsWith("sha256=")
    ? signature.slice(7)
    : signature;

  const expected = createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");

  // timingSafeEqual prevents timing attacks
  return timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(sig,      "hex"),
  );
}