Less boo. More booked. Halloween offer: 30 days free on any paid plan. Claim 30 days free
Workspace-scoped API keys, and HMAC-signed webhooks that fire when a mailbox's health drops, its DNS changes, its authentication fails, or it pauses itself.
The events that matter
Score drops, DNS changes, authentication failures, OAuth disconnects and auto-pauses, not a firehose of replies and opens.
See how it works
{
"id": "evt_example_01",
"type": "score_drop",
"accountId": "acc_example",
"createdAt": "2026-10-09T09:41:02Z",
"payload": {
"severity": "warning",
"title": "Health score dropped",
"scoreBefore": 92,
"scoreAfter": 71
}
}Selected: score_drop. Key on the event id so a repeat delivery does nothing.
Signed deliveries
Every delivery carries an HMAC-SHA256 signature computed with your subscription secret over the raw request body.
See the three stepsPOST https://hooks.example.com/warmerly content-type: application/json x-warmerly-signature: 9f2c41e07ab35d6c88e10f4a72b9d3c5
Keys and endpoints
HTTPS is required, localhost, loopback and private-range literal addresses are refused, and a subscription that fails ten times in a row is disabled.
The mailbox states these events describe
https://hooks.example.com/warmerly Acceptedhttp://hooks.example.com/warmerly Refused, not HTTPShttps://localhost/hook Refused, localhosthttps://10.0.0.5/hook Refused, private rangeDelivery attempts before an event is given up on
The problem
The failure that costs real money is a mailbox that paused itself and stayed paused. It is invisible in every aggregate number, and the fix is not a better dashboard but a signal arriving where your team already looks.
See it work
Keys are scoped to a workspace, shown once at creation and stored hashed. Each webhook subscription has its own secret for verifying payloads.
Why it matters
Score drops, DNS changes, authentication failures, OAuth disconnects and auto-pauses, not a firehose of replies and opens.
Every delivery carries an HMAC-SHA256 signature computed with your subscription secret over the raw request body.
HTTPS is required, localhost, loopback and private-range literal addresses are refused, and a subscription that fails ten times in a row is disabled.
How it works
Keys are scoped to your workspace. Choose the events you want sent to your HTTPS endpoint.
Each event is attempted three times with a short timeout and carries an identifier you can key on.
Compute the HMAC over the raw body, compare in constant time, and route the event to Slack, a pager or a ticket.
The events that matter
The subscribable events are the ones that mean something is wrong with your sending: a health score dropping, a score hitting the floor, a DNS record changing underneath you, SMTP or IMAP authentication failing, OAuth consent disappearing, a mailbox pausing or resuming itself. These are the moments where minutes matter, and where an email to an address nobody reads is not good enough.
Signed, retried, and given up on honestly
Each payload carries an HMAC-SHA256 signature computed with your subscription's secret, so you can verify it came from us and was not altered. Delivery is attempted three times with a short timeout. A subscription that fails ten times consecutively is disabled rather than retried into eternity. A dead endpoint quietly consuming retries is worse than one that visibly stops.
Refuses unsafe targets
Webhook endpoints are a classic server-side request forgery vector: give a system a URL and it will happily fetch your internal network. Warmerly requires HTTPS and rejects localhost, loopback and private-range literal addresses when you create the subscription. At delivery time it also resolves the hostname, rejects the delivery if any returned address is private, loopback, link-local or in the carrier-grade NAT range, and connects only to the address it vetted, so a name that later points inward cannot redirect the request.
There is a version of this feature that fires a webhook on every reply, every open and every click, and it is the version most tools ship. It is also the version that produces a firehose nobody consumes, because reply data is already in the inbox and open data is unreliable enough that acting on it is a mistake.
The events worth waking up for are different in kind: your mailbox lost its OAuth consent, your DKIM record changed, your health score fell through the floor, the system paused a sender because it was doing damage. Each of those has a clear owner and a clear action, and each of them is currently costing you sending capacity for as long as it goes unnoticed.
The failure this exists to prevent
A mailbox that pauses itself and stays paused is invisible in every aggregate number. Total sends drop slightly, and everything else looks normal. Warmerly has seen a mailbox sit unreachable for over two weeks in exactly this way. A webhook into Slack turns that into a two-minute problem.
Each delivery carries a signature computed as an HMAC-SHA256 of the raw request body using your subscription secret. Verification is the standard procedure: take the raw body exactly as received (before any JSON parsing, because re-serialising changes the bytes) compute the HMAC with your secret, and compare against the header using a constant-time comparison.
If the comparison fails, discard the request. Do not process it and log a warning; an unsigned or mis-signed payload arriving at your endpoint is either a bug or someone probing it, and neither is a reason to act on the contents.
Keys are scoped to a workspace, not to your user. That is the right boundary for an agency running several clients in separate workspaces: a key leaked from one client's integration cannot read another client's data. Keys are shown once at creation and stored hashed, so a lost key is replaced rather than recovered.
Sessions and keys are separate concerns and are treated separately. Warmerly's own login no longer issues a long-lived API token as a side effect, a pattern that used to be common and that quietly turned every browser session into a year-long credential. Sessions are server-side and revocable; keys are explicit, listed, and individually revocable.
Related
The common thread is that none of these are analytics. They are operational signals about infrastructure you depend on, and their value is entirely in how quickly they reach a human who can act.
Deliveries are batched per sweep with a per-subscription cap, and the sweep runs on a bounded deadline so it cannot overrun into the next one and re-deliver events against a cursor that never advanced. In practice this means bursts are smoothed rather than dropped, and duplicates are avoided by design rather than by hoping.
You should still make your endpoint idempotent. Every event carries an identifier; keying on it costs nothing and protects you from the general truth that at-least-once delivery is the only kind anyone actually ships.
More from Warmerly
Mailbox and deliverability events: score_drop, score_floor, dns_changed, auth_fail, smtp_fail, imap_fail, oauth_connected, oauth_disconnected, oauth_reconnected, oauth_refresh_fail, auto_paused, auto_resumed, manual_pause, flagged, aged_in and marked_dead.
Compute an HMAC-SHA256 of the raw request body using your subscription secret and compare it to the signature header with a constant-time comparison. Use the raw bytes. Parsing and re-serialising the JSON will change them and the signature will not match.
Each event is attempted three times with a short timeout. After ten consecutive failures the subscription is disabled, so a permanently dead endpoint stops consuming retries. Re-enable it once the endpoint is back.
No. HTTPS is required, and localhost, loopback and private-range literal addresses are rejected when you save the subscription. At delivery time Warmerly also resolves the hostname and refuses any address in a private, loopback, link-local or carrier-grade NAT range, then connects only to the address it vetted.
No. API key access is an Agency plan feature. The keys and webhooks screen tells you where your workspace stands, and the pricing page lists what each plan includes.
Keep reading
Summarize with AI
Signed events for the mailbox failures that quietly cost you sending capacity. Delivered where your team will actually see them.
ChatGPT
Claude
Perplexity