One-click unsubscribe with List-Unsubscribe-Post

POST /unsubscribe/7f3a9c2e5b HTTP/1.1
Host: acme.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 26

List-Unsubscribe=One-Click

// Mail apps POST here when the user clicks Unsubscribe.
// The token identifies the recipient and the list; nothing else is needed.
app.post("/unsubscribe/:token", async (req, res) => {
  const done = await unsubscribeByToken(req.params.token); // your own lookup
  res.sendStatus(done ? 200 : 404); // answer directly: never redirect a one-click POST
});

# Mail apps POST here when the user clicks Unsubscribe.
# The token identifies the recipient and the list; nothing else is needed.
@app.post("/unsubscribe/<token>")
def one_click_unsubscribe(token):
    if not unsubscribe_by_token(token):  # your own lookup
        return "", 404
    return "", 200  # answer directly: never redirect a one-click POST

{
  "subject": "Your weekly Acme activity summary",
  "body": "<p>Hi [FIRST_NAME], here is what happened in your workspace this week.</p>",
  "sender": { "from": { "name": "Acme", "email": "updates@acme.com" } },
  "recipients": {
    "to": [
      { "email": "ann@example.com", "attributes": { "FIRST_NAME": "Ann" } }
    ]
  },
  "headers": {
    "List-Unsubscribe": "<https://acme.com/unsubscribe/7f3a9c2e5b>",
    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click"
  },
  "metadata": { "user_id": "u_1042", "list": "weekly_summary" }
}

// Build one request per recipient so each gets their own unsubscribe URL
const token = await createUnsubscribeToken(user.id, "weekly_summary"); // your own opaque token

await sendEmail({
  subject: "Your weekly Acme activity summary",
  body: "<p>Hi [FIRST_NAME], here is what happened in your workspace this week.</p>",
  sender: { from: { name: "Acme", email: "updates@acme.com" } },
  recipients: { to: [{ email: user.email, attributes: { FIRST_NAME: user.firstName } }] },
  headers: {
    "List-Unsubscribe": `<https://acme.com/unsubscribe/${token}>`,
    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
  },
  metadata: { user_id: user.id, list: "weekly_summary" },
});

# One request per recipient so each gets their own unsubscribe URL
token = create_unsubscribe_token(user.id, "weekly_summary")  # your own opaque token

send_email({
    "subject": "Your weekly Acme activity summary",
    "body": "<p>Hi [FIRST_NAME], here is what happened in your workspace this week.</p>",
    "sender": {"from": {"name": "Acme", "email": "updates@acme.com"}},
    "recipients": {"to": [{"email": user.email, "attributes": {"FIRST_NAME": user.first_name}}]},
    "headers": {
        "List-Unsubscribe": f"<https://acme.com/unsubscribe/{token}>",
        "List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
    },
    "metadata": {"user_id": user.id, "list": "weekly_summary"},
})