Email Webhook Email Integration with Novu

Email Webhook lets Novu hand each email payload to an HTTP endpoint you control. Instead of calling a built-in ESP SDK, Novu POSTs the rendered message to your Webhook URL and signs the body with your HMAC secret. Use this when you want Novu workflows and templates, but delivery goes through an internal service or a provider that is not listed in the Integrations Store.

​

Creating an Email Webhook integration with Novu

1. Visit the Integrations page on Novu.
2. Click Add a provider.
3. Locate Email Webhook under the Email section and click Connect.
4. Enter your:
   • Webhook URL (HTTPS endpoint that accepts POST JSON)
   • Secret Hmac Key (used to sign each request)
   • Secret Hmac Key Encoding (optional) — how Novu interprets your Secret Hmac Key when signing requests. Defaults to Text. Choose Base-64 or HEX if your verification side stores the key as binary material (for example, an AWS KMS imported key).
   • From email address
   • Sender name
5. Confirm Active Integration is on. New integrations start active by default.
6. Click Create Integration.

​

Request format

For each email, Novu sends a POST request to your webhook URL with:

• Content-Type: application/json
• X-Novu-Signature: <hmac-sha256-hex> of the raw JSON body, using your Secret Hmac Key

Verify the signature before processing the payload. Reject requests that do not match. The JSON body includes the rendered email fields Novu already prepared for the subscriber (to, from, subject, html/text content, and related metadata).

​

Secret Hmac Key encoding

By default, Novu interprets your Secret Hmac Key as plain Text (UTF-8 bytes) when computing the HMAC. If the system that verifies the signature holds the key as binary material — for example an AWS KMS imported key — set Secret Hmac Key Encoding to match how the key is stored so both sides sign with the same bytes: The encoding only changes how the stored key is decoded into signing bytes; the resulting X-Novu-Signature is still a hex-encoded HMAC-SHA256 of the raw request body.

​

Next Steps