Can I send to Zapier, Make, or n8n?

Yes. Paste in the URL those tools give you. Add a secret when the tool can check that the message came from Postbag.

Does email come from my own domain?

Not on Postbag Cloud yet: messages come from a Postbag address and Reply goes to the person who wrote in. When you self-host, you use your own sending domain.

How does another service know the message came from Postbag?

Add a secret, then use the short verification example in the webhook docs. Your agent can handle the technical check for you.

Your inbox, Telegram, or wherever comes next

Email that answers the right person

A notification arrives in your inbox. Hit Reply and you are replying to the person who filled in the form, not a no-reply address. Small thing. Important thing.

Telegram when you are away from your desk

Send a note into a Telegram chat for a quick heads-up. Postbag keeps it readable, so you do not have to decode a tiny wall of text on your phone.

A door to the rest of your tools

Use a webhook for your CRM, Zapier, Make, n8n, or a small thing you built on a Saturday. Add a secret and Postbag gives the receiving service a way to check the message really came from you. If the other side is unavailable, Postbag tries up to 10 times, then leaves the send clear and ready for you to retry after recovery.

What your agent sees: verify a signed message

import { createHmac, timingSafeEqual } from "node:crypto"

export function verify(secret: string, header: string, rawBody: string, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map((kv) => kv.split("=") as [string, string]))
  const t = Number(parts.t)
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex")
  return timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1 ?? ""))
}

import { createHmac, timingSafeEqual } from "node:crypto"

export function verify(secret: string, header: string, rawBody: string, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map((kv) => kv.split("=") as [string, string]))
  const t = Number(parts.t)
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex")
  return timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1 ?? ""))
}

Test before you trust

Send a real sample and see what arrives before you switch a form on. Agents do this as part of setup. It is a good habit for humans too.

More places soon

Slack and Discord are next in line. Until their native adapters arrive, configure a signed Postbag webhook for services that accept its delivery envelope.