Create, bind and deliver each message code safely
-
1
Load the API key on the server
Read the key from the application secret manager or process environment. Never bundle it into frontend JavaScript, a server-rendered page or a public source map.
-
2
Generate stable send identifiers
Create the RFC Message-ID and an idempotency key when the send job is created. Store them with the queue job so retries reuse the same values.
-
3
Request the message code
POST the Message-ID and idempotency key to VerifySeal with a bounded timeout and Authorization Bearer header. Validate the HTTP status and response structure.
-
4
Build the Nodemailer message
Set messageId to the submitted value, add message_code.header to the headers collection, and append the returned text and HTML footers to their matching bodies.
-
5
Sign and send last
Only pass the completed message to the transporter after the VEM response succeeds. Configure Nodemailer DKIM on that transporter or confirm the downstream provider signs without rewriting the identity.
-
6
Inspect a delivered message
Check the original received message for the same Message-ID, the VEM header/footer and passing aligned DKIM/DMARC. Some delivery providers replace Message-ID, which breaks the match.