Recibe correos en tu app.

import express from 'express';
import { verifyWebhook } from 'postal-so';

const app = express();
const api = { Authorization: `Bearer ${process.env.POSTAL_API_KEY}` };

// El cuerpo debe llegar sin procesar para que la firma coincida
app.post('/webhooks/postal', express.raw({ type: 'application/json' }), async (req, res) => {
  let event;
  try {
    event = verifyWebhook(req.body, req.headers, process.env.POSTAL_WEBHOOK_SECRET);
  } catch {
    return res.sendStatus(400);
  }

  if (event.type === 'email.received') {
    const { email_id, from, subject } = event.data;
    const email = await fetch(`https://api.postal.so/emails/receiving/${email_id}`, { headers: api })
      .then((response) => response.json());

    // email.text, email.html y email.attachments[].download_url
    await abrirTicket({ from, subject, texto: email.text, adjuntos: email.attachments });
  }

  res.sendStatus(200);
});

use Postal\Exceptions\WebhookVerificationException;
use Postal\Webhook;

try {
    $event = Webhook::verify(file_get_contents('php://input'), getallheaders(), getenv('POSTAL_WEBHOOK_SECRET'));
} catch (WebhookVerificationException $e) {
    http_response_code(400);
    exit;
}

if ($event['type'] === 'email.received') {
    $id = $event['data']['email_id'];
    $api = stream_context_create(['http' => ['header' => 'Authorization: Bearer ' . getenv('POSTAL_API_KEY')]]);
    $email = json_decode(file_get_contents("https://api.postal.so/emails/receiving/{$id}", false, $api), true);

    // $email['text'], $email['html'] y los adjuntos, con el enlace de descarga
    foreach ($email['attachments'] as $adjunto) {
        $nombre = basename($adjunto['filename'] ?? $adjunto['id']);
        file_put_contents("/var/adjuntos/{$nombre}", file_get_contents($adjunto['download_url']));
    }
}

http_response_code(200);

# El mensaje completo: texto, HTML, encabezados y adjuntos
curl https://api.postal.so/emails/receiving/019a1c00-3e4f-7a5b-9c6d-7e8f9a0b1c2d \
  -H "Authorization: Bearer $POSTAL_API_KEY"

# Un adjunto: el download_url está firmado y vale 1 hora (no necesita la clave)
curl -o nota-fiscal-10475.pdf "$DOWNLOAD_URL"

# El mensaje original, tal como llegó al servidor
curl https://api.postal.so/emails/receiving/019a1c00-3e4f-7a5b-9c6d-7e8f9a0b1c2d/raw \
  -H "Authorization: Bearer $POSTAL_API_KEY"