email-webhook
Public webhook receiver for Resend inbound mail (email.received). Supabase JWT verification is
disabled for this function — Resend posts directly, and the Svix signature
(webhook-id/webhook-timestamp/webhook-signature) is the authentication, verified with the
same verifier fathom-webhook uses.
Fails closed with 503 until RESEND_WEBHOOK_SECRET is set (edge secret, or a Vault fallback).
Because the inbound subdomain is a catch-all shared by every AI tool in the org, the function
additionally drops any email whose recipient doesn't exactly match SABLE_INBOUND_ADDRESS.
Full connector detail is on the Email BCC / Attachment Inbox page.
Where the code lives
sable-agents-demo/supabase/functions/email-webhook/index.tssable-agents-demo/supabase/functions/_shared/fathom.js—verifyFathomSignature, shared withfathom-webhook