sent-integration-starter

Sent Integration Starter stands up a production-ready Sent v3 messaging integration in an existing codebase. It solves the problem that most broken integrations authenticate and send but skip the receiver and hardening, by structuring the work into four explicit stages - authenticate, send idempotently, receive verified events, then harden - and refusing to conflate them.

Stage one covers SDK selection across TypeScript, Python, Go, Java, C#, PHP, and Ruby, client construction, and x-api-key authentication (with notes on Bearer-accepting proxies, MCP OAuth, and x-profile-id behavior), including reading credentials from SENT_DM_API_KEY / SENT_DM_WEBHOOK_SECRET environment variables and validating configuration at boot. Stage two covers idempotent sends: supplying to plus template or text, omitting channel so automatic routing applies (never writing a multi-value channel array that broadcasts and multiplies charges), sending a deterministically derived Idempotency-Key on every mutating call, and treating 202 as accepted rather than delivered. Stage three builds a verified webhook receiver with HMAC-SHA256 verification over id.timestamp.raw_body, constant-time comparison, a 300-second timestamp window, and dedupe keys, since no SDK ships a verifier. A reference catalog documents all 46 error codes with per-family retry classification, rate-limit and lockout behavior, and sandbox semantics, and a preflight.py script supports pre-launch checks.

It targets developers adding Sent to an app for the first time, choosing an SDK or wiring a framework, handling 429 or 409 responses, deciding what to log, or hardening before launch. Its guidance is security-conscious: credentials come from environment variables via official SDKs, tenant credentials are isolated per request in multi-tenant proxies, and signatures are verified in constant time - with no exfiltration or unsafe execution.