Integrations

Email from SvelteKit actions and endpoints.

SvelteKit draws a hard line between server and client modules, and Notix belongs on the server side of it. Import the key from $env/static/private, which SvelteKit refuses to bundle for the browser, and send from a form action or a +server.ts endpoint.

The send

Send an email from SvelteKit.

src/routes/checkout/+page.server.ts

import { fail } from "@sveltejs/kit";
import { NOTIX_API_KEY } from "$env/static/private";
import { Notix } from "notix-js";

const notix = new Notix(NOTIX_API_KEY);

export const actions = {
  default: async ({ request }) => {
    const form = await request.formData();
    const { data, error } = await notix.emails.send({
      from: "Acme <receipts@acme.com>",
      to: String(form.get("email")),
      subject: "Your receipt",
      html: "<p>Thanks for your order.</p>",
    });
    if (error) return fail(502, { message: error.message });
    return { id: data?.emailId };
  },
};

The from address must be on a domain you have verified in Notix. Step by step: the Node.js quickstart and the longer guide to sending email from SvelteKit.

Environment

One API key, kept on the server.

Create an API key on the API keys page of the Notix console and store it as NOTIX_API_KEY in .env, imported through $env/static/private. Read it only in code that runs on the server, never in anything shipped to a browser.

A Send only key is enough for code that only sends: if it leaks, it cannot read your contacts or delete a domain.

.env

NOTIX_API_KEY=notix_xxxxxxxxxxxx
NOTIX_WEBHOOK_SECRET=whsec_xxxxxxxxxxxx

Webhooks

Verify delivery events over the raw body.

Notix signs every webhook call with the webhook's signing secret: an HMAC-SHA256 of the X-Notix-Timestamp header, a dot and the raw body, sent in X-Notix-Signature. The SDKs check the signature and refuse a call more than 5 minutes old.

Call request.text() before anything parses the body: the signature covers the exact bytes Notix sent.

src/routes/webhooks/notix/+server.ts: export the handler as POST

import { Notix } from "notix-js";

const notix = new Notix(process.env.NOTIX_API_KEY!);
const webhooks = notix.webhooks(process.env.NOTIX_WEBHOOK_SECRET!);

export async function handleNotixWebhook(request: Request): Promise<Response> {
  const rawBody = await request.text();
  try {
    const event = webhooks.constructEvent(rawBody, { headers: request.headers });
    if (event.type === "email.bounced") {
      // Mark the address in your own records.
    }
    return new Response("ok");
  } catch {
    return new Response("invalid signature", { status: 400 });
  }
}

FAQ

Questions, answered.

Why $env/static/private and not $env/static/public?

SvelteKit only lets server modules import from $env/static/private and fails the build if client code tries, so the key cannot leak. Anything in $env/static/public is shipped to the browser.

What if the same request runs twice?

Send an Idempotency-Key header (idempotencyKey in notix-js) with a value that names the thing being sent, such as order-4471-receipt. A repeat with the same key and body returns the first result and sends nothing new; the same key with a different body is refused with 409.

Why is my send refused with a from-address error?

The from address must be on a domain you have verified in Notix. Add the domain in the console, publish the DNS records it shows, and wait for verification; until then, sends from that domain are refused.

The free plan does not ask for a card.

Guides