Configure

Cleanup webhook

Let your app delete the throwaway account after each run.

Updated September 4, 2026

After every run Mystra POSTs to a URL you set in Settings → Path, so your app can delete the throwaway user and anything created for it, such as a Stripe customer.

Request body· json

{ "event": "run.finished", "runId": "…", "email": "run-1a2b3c4d@inbox.mystra.run", "outcome": "passed" }

The body is signed with X-Mystra-Signature: sha256=<HMAC-SHA256 of the raw body> using the app's outgoing secret, shown next to the field in settings. Verify it before deleting anything:

app/api/mystra/cleanup/route.ts· ts

import { createHmac, timingSafeEqual } from "node:crypto";

export async function POST(req: Request) {
  const raw = await req.text();
  const expected = `sha256=${createHmac("sha256", process.env.MYSTRA_OUTGOING_SECRET!).update(raw).digest("hex")}`;
  const given = req.headers.get("x-mystra-signature") ?? "";
  if (given.length !== expected.length || !timingSafeEqual(Buffer.from(given), Buffer.from(expected)))
    return new Response("bad signature", { status: 401 });
  const { email } = JSON.parse(raw) as { email: string };
  if (!email.endsWith("@inbox.mystra.run")) return new Response("ignored");
  await deleteUserByEmail(email);
  return new Response("ok");
}