How to Send Email from Cloudflare Workers

import { AhaSendClient } from "@ahasend/sdk";
export default {
  async fetch(request, env) {
    if (request.method !== "POST") return new Response(null, { status: 405 });
    try {
      const client = new AhaSendClient({ apiKey: env.AHASEND_API_KEY, accountId: env.AHASEND_ACCOUNT_ID, fetch: fetch.bind(globalThis) });
      const result = await client.messages.send({
        from: { email: env.AHASEND_FROM },
        recipients: [{ email: "recipient@example.com" }],
        subject: "My first sandbox email", text_content: "Hello from AhaSend",
        sandbox: true,
      });
      const statuses = result.data.map((item) => item.status);
      const accepted = statuses.length > 0 && statuses.every((s) => ["queued", "scheduled"].includes(s));
      return Response.json({ statuses }, { status: accepted ? 202 : 422 });
    } catch {
      return new Response("Sandbox send failed", { status: 502 });
    }
  },
};

.dev.vars*
.env*

export interface Env {
  AHASEND_API_KEY: string;
  AHASEND_ACCOUNT_ID: string;
  AHASEND_WEBHOOK_SECRET: string;
  AHASEND_SEND_TOKEN: string;
}

import { AhaSendClient, AhaSendAPIError } from "@ahasend/sdk";

async function tokenMatches(header: string | null, expected: string): Promise<boolean> {
  const supplied = header?.startsWith("Bearer ") ? header.slice(7) : "";
  if (!supplied) return false;
  const hash = (value: string) => crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
  const [a, b] = await Promise.all([hash(supplied), hash(expected)]);
  const left = new Uint8Array(a), right = new Uint8Array(b);
  let difference = 0;
  for (let i = 0; i < left.length; i++) difference |= left[i] ^ right[i];
  return difference === 0;
}

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const url = new URL(request.url);

    if (request.method === "POST" && url.pathname === "/api/welcome") {
      if (
        !env.AHASEND_SEND_TOKEN ||
        !(await tokenMatches(request.headers.get("authorization"), env.AHASEND_SEND_TOKEN))
      ) {
        return new Response("Unauthorized", { status: 401 });
      }

      // Bound the read before it happens: Workers accept request bodies of
      // 100 MB and up, and `request.json()` buffers all of it into a 128 MB
      // isolate. A body with no declared length is refused outright.
      const declaredLength = Number(request.headers.get("content-length") ?? NaN);
      if (!Number.isFinite(declaredLength) || declaredLength > 4096) {
        return Response.json({ error: "Payload too large" }, { status: 413 });
      }

      let body: { email?: unknown; name?: unknown; eventId?: unknown };
      try {
        body = await request.json();
      } catch {
        return Response.json({ error: "Invalid JSON" }, { status: 400 });
      }

      if (
        typeof body.email !== "string" ||
        (body.name !== undefined && typeof body.name !== "string") ||
        typeof body.eventId !== "string" ||
        !/^[A-Za-z0-9._:-]{1,200}$/.test(body.eventId)
      ) {
        return Response.json({ error: "Invalid request" }, { status: 400 });
      }

      const ahasend = new AhaSendClient({
        apiKey: env.AHASEND_API_KEY,
        accountId: env.AHASEND_ACCOUNT_ID,
        fetch: fetch.bind(globalThis),
      });

      try {
        const sandbox = true; // Set to false only when ready to deliver real mail.
        const result = await ahasend.messages.send({
          from: { email: "hello@yourdomain.com", name: "Your App" },
          recipients: [{ email: body.email, name: body.name }],
          subject: "Welcome to Your App",
          html_content: "<h1>Welcome aboard</h1><p>We're glad you're here.</p>",
          text_content: "Welcome aboard. We're glad you're here.",
          sandbox,
        }, {
          idempotencyKey: `${sandbox ? "sandbox" : "live"}-welcome-${body.eventId}`,
        });

        const rejected = result.data.filter((r) => r.status === "error");
        if (rejected.length > 0) {
          console.warn("AhaSend rejected a recipient", { failedCount: rejected.length });
          return Response.json({ error: "Recipient rejected" }, { status: 502 });
        }

        return Response.json({ accepted: true });
      } catch (err) {
        if (err instanceof AhaSendAPIError) {
          console.error(`AhaSend error ${err.status} (request ${err.requestId})`);
          return Response.json({ error: "Failed to send email" }, { status: 502 });
        }
        throw err;
      }
    }

    return new Response("Not found", { status: 404 });
  },
};

import {
  WebhookVerifier,
  isKnownWebhookEvent,
  nextRouteHandler,
} from "@ahasend/sdk/webhooks";

// inside the same fetch handler, above the final 404 return:
if (request.method === "POST" && url.pathname === "/webhooks/ahasend") {
  const verifier = new WebhookVerifier(env.AHASEND_WEBHOOK_SECRET);

  return nextRouteHandler(
    verifier,
    async (event, verifiedRequest) => {
      const webhookId = verifiedRequest.headers.get("webhook-id");
      if (isKnownWebhookEvent(event) && webhookId) {
        console.log("Verified AhaSend webhook", { type: event.type, webhookId });
      }
      return new Response(null, { status: 200 });
    },
    { maxBodyBytes: 30_000_000 },
  )(request);
}