How to Send Email with Express

AHASEND_API_KEY=aha-sk-...
AHASEND_ACCOUNT_ID=your-account-uuid
AHASEND_WEBHOOK_SECRET=aha-whsec-...
WELCOME_ENDPOINT_TOKEN=replace-with-a-long-random-value

import { AhaSendClient } from "@ahasend/sdk";

export const ahasend = new AhaSendClient({
  apiKey: process.env.AHASEND_API_KEY!,
  accountId: process.env.AHASEND_ACCOUNT_ID!,
});

import express, { type ErrorRequestHandler } from "express";
import { timingSafeEqual } from "node:crypto";
import { AhaSendAPIError } from "@ahasend/sdk";
import { ahasend } from "./lib/ahasend.js";

const app = express();
const welcomeEndpointToken = process.env.WELCOME_ENDPOINT_TOKEN;
if (!welcomeEndpointToken) throw new Error("WELCOME_ENDPOINT_TOKEN is required");
const expectedAuthorization = Buffer.from(`Bearer ${welcomeEndpointToken}`);

function isAuthorized(header: string | undefined): boolean {
  const supplied = Buffer.from(header ?? "");
  return (
    supplied.length === expectedAuthorization.length &&
    timingSafeEqual(supplied, expectedAuthorization)
  );
}

app.post(
  "/api/welcome",
  (req, res, next) => {
    if (!isAuthorized(req.get("authorization"))) {
      res.status(401).json({ error: "Unauthorized" });
      return;
    }
    next();
  },
  express.json({ limit: "16kb" }),
  async (req, res) => {
    const { email, name, eventId } = req.body ?? {};
    if (
      typeof email !== "string" ||
      email.length < 3 ||
      email.length > 320 ||
      (name !== undefined && (typeof name !== "string" || name.length > 100)) ||
      typeof eventId !== "string" ||
      !/^[A-Za-z0-9._:-]{1,200}$/.test(eventId)
    ) {
      res.status(400).json({ error: "Invalid request body" });
      return;
    }

    try {
      const result = await ahasend.messages.send(
        {
          from: { email: "hello@yourdomain.com", name: "Your App" },
          recipients: [{ email, name }],
          subject: "Welcome to Your App!",
          html_content: "<h1>Welcome aboard 🎉</h1><p>We're glad you're here.</p>",
          text_content: "Welcome aboard! We're glad you're here.",
        },
        { idempotencyKey: `welcome-${eventId}` },
      );

      const rejected = result.data.filter((r) => r.status === "error");
      if (rejected.length > 0) {
        console.warn(`${rejected.length} recipient(s) rejected`);
        res.status(502).json({ error: "Recipient was not accepted" });
        return;
      }

      res.status(202).json({ accepted: true });
    } catch (err) {
      if (err instanceof AhaSendAPIError) {
        console.error(`AhaSend error ${err.status} (request ${err.requestId})`);
        res.status(502).json({ error: "Failed to send email" });
        return;
      }
      throw err;
    }
  },
);

const opaqueErrorHandler: ErrorRequestHandler = (err, _req, res, next) => {
  if (res.headersSent) {
    next(err);
    return;
  }

  const candidate =
    typeof err === "object" && err !== null && "status" in err
      ? (err as { status?: unknown }).status
      : undefined;
  const status = candidate === 400 || candidate === 413 ? candidate : 500;
  console.error("Request failed");
  res.status(status).json({ error: status === 500 ? "Internal server error" : "Invalid request" });
};

import {
  WebhookVerifier,
  expressWebhookHandler,
  isKnownWebhookEvent,
} from "@ahasend/sdk/webhooks";

const verifier = new WebhookVerifier(process.env.AHASEND_WEBHOOK_SECRET!);

// No body parser is mounted on this path.
app.post(
  "/webhooks/ahasend",
  expressWebhookHandler(verifier, async (event) => {
    if (!isKnownWebhookEvent(event)) return; // future event type, acknowledge & ignore

    switch (event.type) {
      case "message.delivered":
        console.log("Message delivered");
        break;
      case "message.bounced":
        console.log("Message bounced");
        break;
      case "message.opened":
        console.log("Message opened");
        break;
    }
  }, { maxBodyBytes: 1_000_000 }),
);

// Error middleware must be registered after every route.
app.use(opaqueErrorHandler);
app.listen(3000);