Skip to main content

​
Resend email inbox

Agentbot can receive inbound emails through a Resend webhook. Emails from approved senders are processed and forwarded to your agent for handling.

​
How it works

  1. A user sends an email to your Resend inbox address
  2. Resend forwards the email to POST /api/webhooks/resend
  3. Agentbot verifies the webhook signature, checks the sender against an allowlist, and applies rate limiting
  4. Approved emails are processed and made available to your agent

​
Setup

1

Create a Resend webhook

In the Resend dashboard, create a webhook pointing to:
Subscribe to the email.received event type.
2

Configure environment variables

Add the following environment variables to your deployment:
3

Test the integration

Send an email from one of the allowed sender addresses to your Resend inbox. Check the agent logs to confirm it was received and processed.

​
Webhook endpoint

Receives inbound email events from Resend. This endpoint verifies the webhook signature using Svix headers and enforces a strict sender allowlist.
This endpoint is intended to be called by Resend only. You must configure the RESEND_WEBHOOK_SECRET environment variable for signature verification. When the secret is not configured, the endpoint returns 500.

​
Headers

​
Signature verification

The endpoint verifies the webhook payload using the Resend SDK’s built-in signature verification. Requests with invalid or missing signatures are acknowledged with 200 to prevent Resend from retrying.

​
Handled event types

​
Response

The endpoint always returns 200 to prevent Resend from retrying delivery.

​
Security

​
Sender allowlist

Only emails from addresses listed in the ALLOWED_SENDERS environment variable are processed. All other emails are rejected and logged for audit. This is a strict allowlist — there is no wildcard or domain-level matching.

​
Rate limiting

Each allowed sender is limited to 10 emails per hour. Emails that exceed this limit are acknowledged but not processed.

​
Content sanitization

Email bodies are sanitized before processing:
  • Script tags and HTML markup are stripped
  • Body text is truncated to 5,000 characters

​
Troubleshooting

Verify that the RESEND_WEBHOOK_SECRET environment variable is set. The endpoint cannot verify signatures without it.
Check that the sender’s email address is included in ALLOWED_SENDERS. Addresses are matched in a case-insensitive manner.
The limit is 10 emails per sender per hour. Wait for the rate limit window to reset or adjust the sending frequency.