Rovela signs every webhook delivery with HMAC-SHA256 in the x-resend-signature header (t=…,v1=…). This article walks through verification step by step, with special attention to three common mistakes: raw body handling, replay protection, and constant-time comparison.
Rovela's scheduled_at field queues email for delivery at a future time, with support for rescheduling and cancellation. This article walks through the full flow and shows how to compute send times in the recipient's time zone.
Retrying after a timeout is the most common cause of duplicate emails. Rovela's idempotency key deduplicates within a 24-hour window — this article covers the rules, how to choose keys, and pairing them with backoff retry.
Rovela batch API, cursor-based pagination for large lists, exponential backoff, send timing, and progress tracking.
Rovela's attachment API, provider size limits, switching to download links for large files, security considerations, and Content-Type.
The difference between bounce types, receiving bounce webhooks, rate thresholds, and prevention strategies.
The constraints of email HTML, table layouts, inline styles, React Email and MJML, and testing tools.
Event-driven architecture to decouple email sending, with signature verification, idempotency, and Rovela Automations.
Cryptographically secure token generation, hash storage, expiry, rate limiting, and single-use enforcement.
The common security gaps in email OTP implementations — code strength, expiry, rate limiting, constant-time comparison, user enumeration, and logging — and how to address each one.
How to send one-time passcodes by email using SMTP or a transactional email API, with code examples for secure random generation, Redis-backed validation, and rate limiting.