Create, bind and deliver each message code safely
-
1
Configure the server secret
Put the API key in the deployment secret store and expose it through a private Laravel configuration value. Never call env directly from a Blade view or expose the value to client-side code.
-
2
Create IDs in the send job
Generate the final Message-ID and a stable idempotency key in the queued send job. Persist both with the job so queue retries do not create a new identity or a second code.
-
3
Call VerifySeal before rendering
Use Laravel’s HTTP client with a Bearer token, JSON body and bounded timeout. Stop or retry the job unless the endpoint returns a valid message_code object.
-
4
Pass values to the Mailable
Set the Mailable Headers messageId to the submitted value and add message_code.header as a text header. Pass the returned HTML and text footers into the corresponding mail views.
-
5
Render before transport signing
The complete HTML, text and headers must be finalized before the configured Symfony mail transport or downstream provider applies DKIM. Do not modify the message in a later listener.
-
6
Test the queue and provider
Run a real queued send, inspect the received source and retry the same job once in a safe environment. The retry must keep one Message-ID and one VEM code.