Messaging & Communications Integration Guide
Test Mailgun Webhooks Online
Test Mailgun email delivered, opened, clicked, bounced, and dropped webhooks with instant signature verification.
Direct Answer / Quick Summary
To test Mailgun webhooks, navigate to Mailgun Dashboard > Sending > Webhooks, select your domain, add your SafeWebhook URL for event types, and click Test Webhook.
Key Capabilities & Testing Highlights
- •Mailgun puts signature object inside the JSON body.
- •Inspect email delivery events, spam complaints, and temporary drop errors.
- •Instant verification recipes in Node and Python.
- •Zero storage ensures customer email contents remain private.
Signature Header
signature.signature (JSON payload)
Cryptographic Scheme
HMAC-SHA256 (timestamp + token)
Payload Retention
100% Client-Side
Step-by-Step Mailgun Webhook Setup
Follow these 4 simple steps to capture real-time Mailgun events in your browser:
1
Open Mailgun Dashboard > Sending > Webhooks.
2
Select your sending domain and click "Add Webhook".
3
Paste your SafeWebhook URL and select the event type (e.g. Delivered Messages).
4
Click "Test Webhook" to send a sample payload.
Sample Mailgun Webhook Payload
application/json{
"signature": {
"timestamp": "1755541200",
"token": "d8921849102938491029384910293849",
"signature": "9821849102938491029384910293849102938491029384910293849102938491"
},
"event-data": {
"event": "delivered",
"id": "EVT89218491029",
"timestamp": 1755541200,
"message": {
"headers": {
"to": "recipient@example.com",
"from": "noreply@yourdomain.com",
"subject": "Account Activation"
}
},
"recipient": "recipient@example.com"
}
}Mailgun Signature Verification Recipes
Copy-paste production-ready HMAC verification code for your backend:
Node.js / Express Recipecrypto.timingSafeEqual
const crypto = require('crypto');
function verifyMailgunSignature(token, timestamp, signature, signingKey) {
const value = timestamp + token;
const hash = crypto.createHmac('sha256', signingKey).update(value).digest('hex');
return crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(signature));
}Python / Flask / FastAPI Recipehmac.compare_digest
import hmac
import hashlib
def verify_mailgun(token, timestamp, signature, signing_key):
encoded = f"{timestamp}{token}".encode('utf-8')
computed = hmac.new(signing_key.encode('utf-8'), encoded, hashlib.sha256).hexdigest()
return hmac.compare_digest(computed, signature)Frequently Asked Questions: Mailgun Webhooks
Where does Mailgun transmit the signature for verification?
Unlike providers that use HTTP headers, Mailgun embeds the signature metadata (`timestamp`, `token`, `signature`) directly inside the JSON request body.
Ready to test Mailgun webhooks in real-time?
Get your free, private edge endpoint instantly. Zero signup, zero credit card, 100% free forever.