Unsubscribe By Token

One-click unsubscribe via token or email (no login required).

POST is required, not optional: every message carries List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058), and Gmail and Outlook honour that by POSTing to this URL. While this route was GET-only they got 405, so the mailbox told the reader they were unsubscribed and nothing here ever ran. The next newsletter arriving after that is what turns an unsubscribe into a spam complaint.

GET is kept because it is what the visible body link uses, and links in already-delivered mail must keep working. The token carries the identity in both cases, and repeating either verb is idempotent.

A bare ?email= with no token proves nothing about the caller. It used to HARD-DELETE that address's subscription, and the 200-vs-404 answer told anyone whether an address was subscribed (security scan 2026-10-15, finding 12). It now changes nothing and returns the same page whatever the address, pointing at the token link in the mail and the signed-in route (DELETE /api/subscribe), which still work. No current mailer emits a tokenless link (tests/test_newsletter_unsubscribe_token.py).