How to Send Email with Cloudflare Workers

.dev.vars*
.env*

export interface Env {
  AHASEND_API_KEY: string;
  AHASEND_ACCOUNT_ID: string;
  AHASEND_WEBHOOK_SECRET: string;
  AHASEND_SEND_TOKEN: string;
}

import { AhaSendClient, AhaSendAPIError } from "@ahasend/sdk";

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const url = new URL(request.url);

    if (request.method === "POST" && url.pathname === "/api/welcome") {
      if (
        !env.AHASEND_SEND_TOKEN ||
        request.headers.get("authorization") !== `Bearer ${env.AHASEND_SEND_TOKEN}`
      ) {
        return new Response("Unauthorized", { status: 401 });
      }

      // Bound the read before it happens: Workers accept request bodies of
      // 100 MB and up, and `request.json()` buffers all of it into a 128 MB
      // isolate. A body with no declared length is refused outright.
      const declaredLength = Number(request.headers.get("content-length") ?? NaN);
      if (!Number.isFinite(declaredLength) || declaredLength > 4096) {
        return Response.json({ error: "Payload too large" }, { status: 413 });
      }

      let body: { email?: unknown; name?: unknown; eventId?: unknown };
      try {
        body = await request.json();
      } catch {
        return Response.json({ error: "Invalid JSON" }, { status: 400 });
      }

      if (
        typeof body.email !== "string" ||
        (body.name !== undefined && typeof body.name !== "string") ||
        typeof body.eventId !== "string" ||
        !/^[A-Za-z0-9._:-]{1,200}$/.test(body.eventId)
      ) {
        return Response.json({ error: "Invalid request" }, { status: 400 });
      }

      const ahasend = new AhaSendClient({
        apiKey: env.AHASEND_API_KEY,
        accountId: env.AHASEND_ACCOUNT_ID,
      });

      try {
        const sandbox = true;
        const result = await ahasend.messages.send({
          from: { email: "hello@yourdomain.com", name: "Your App" },
          recipients: [{ email: body.email, name: body.name }],
          subject: "Welcome to Your App",
          html_content: "<h1>Welcome aboard</h1><p>We're glad you're here.</p>",
          text_content: "Welcome aboard. We're glad you're here.",
          sandbox,
        }, {
          idempotencyKey: `${sandbox ? "sandbox" : "live"}-welcome-${body.eventId}`,
        });

        const rejected = result.data.filter((r) => r.status === "error");
        if (rejected.length > 0) {
          console.warn("AhaSend rejected a recipient", { failedCount: rejected.length });
          return Response.json({ error: "Recipient rejected" }, { status: 502 });
        }

        return Response.json({ accepted: true });
      } catch (err) {
        if (err instanceof AhaSendAPIError) {
          console.error(`AhaSend error ${err.status} (request ${err.requestId})`);
          return Response.json({ error: "Failed to send email" }, { status: 502 });
        }
        throw err;
      }
    }

    return new Response("Not found", { status: 404 });
  },
};

import {
  WebhookVerifier,
  isKnownWebhookEvent,
  nextRouteHandler,
} from "@ahasend/sdk/webhooks";

// inside the same fetch handler, above the final 404 return:
if (request.method === "POST" && url.pathname === "/webhooks/ahasend") {
  const verifier = new WebhookVerifier(env.AHASEND_WEBHOOK_SECRET);

  return nextRouteHandler(
    verifier,
    async (event, verifiedRequest) => {
      const webhookId = verifiedRequest.headers.get("webhook-id");
      if (isKnownWebhookEvent(event) && webhookId) {
        console.log("Verified AhaSend webhook", { type: event.type, webhookId });
      }
      return new Response(null, { status: 200 });
    },
    { maxBodyBytes: 1_000_000 },
  )(request);
}