Receive email in your app.

import express from 'express';
import { verifyWebhook } from 'postal-so';

const app = express();
const api = { Authorization: `Bearer ${process.env.POSTAL_API_KEY}` };

// The body must arrive raw for the signature to match
app.post('/webhooks/postal', express.raw({ type: 'application/json' }), async (req, res) => {
  let event;
  try {
    event = verifyWebhook(req.body, req.headers, process.env.POSTAL_WEBHOOK_SECRET);
  } catch {
    return res.sendStatus(400);
  }

  if (event.type === 'email.received') {
    const { email_id, from, subject } = event.data;
    const email = await fetch(`https://api.postal.so/emails/receiving/${email_id}`, { headers: api })
      .then((response) => response.json());

    // email.text, email.html and email.attachments[].download_url
    await openTicket({ from, subject, text: email.text, attachments: email.attachments });
  }

  res.sendStatus(200);
});

use Postal\Exceptions\WebhookVerificationException;
use Postal\Webhook;

try {
    $event = Webhook::verify(file_get_contents('php://input'), getallheaders(), getenv('POSTAL_WEBHOOK_SECRET'));
} catch (WebhookVerificationException $e) {
    http_response_code(400);
    exit;
}

if ($event['type'] === 'email.received') {
    $id = $event['data']['email_id'];
    $api = stream_context_create(['http' => ['header' => 'Authorization: Bearer ' . getenv('POSTAL_API_KEY')]]);
    $email = json_decode(file_get_contents("https://api.postal.so/emails/receiving/{$id}", false, $api), true);

    // $email['text'], $email['html'] and the attachments, with the download link
    foreach ($email['attachments'] as $attachment) {
        $name = basename($attachment['filename'] ?? $attachment['id']);
        file_put_contents("/var/attachments/{$name}", file_get_contents($attachment['download_url']));
    }
}

http_response_code(200);

# The whole message: text, HTML, headers and attachments
curl https://api.postal.so/emails/receiving/019a1c00-3e4f-7a5b-9c6d-7e8f9a0b1c2d \
  -H "Authorization: Bearer $POSTAL_API_KEY"

# An attachment: download_url is signed and valid for 1 hour (no key needed)
curl -o nota-fiscal-10475.pdf "$DOWNLOAD_URL"

# The original message, as it reached the server
curl https://api.postal.so/emails/receiving/019a1c00-3e4f-7a5b-9c6d-7e8f9a0b1c2d/raw \
  -H "Authorization: Bearer $POSTAL_API_KEY"