Key Takeaways
- The Android SMS gateway app webhook is how your backend hears DLR and inbound SMS without polling forever.
- Verify signatures. An open POST endpoint will collect forged “delivered” events.
- Handlers must be idempotent. Carriers and retries will double-fire.
- A missing webhook is not proof the SMS never left the SIM.
- Isolate OTP devices so campaign traffic cannot starve callback processing either.
- Live field names live in Developer Center. This page is the operational contract.
What the app webhook is for
An Android SMS gateway app webhook is the callback path for delivery and inbound events after the phone’s SIM did (or did not) send. Teams search this when they wired send and forgot listen — or when a “delivered” tile in the panel never showed up in their CRM.
The last mile is still your operator. We meter devices and platform SMS volume. You supply the handset and airtime. Webhooks do not include carrier credit. Free is 300 SMS lifetime; Developer 25,000 per year; Starter / Professional / Business uncap platform volume and still cap devices.
“If you do not verify the signature, you do not have a webhook. You have a suggestion box on the public internet.”
Events you should handle
Typical shapes: accepted/queued, sent, delivered, failed, inbound received. Exact names belong in the SMS API documentation. Product overview: SMS webhook integration. Inbound replies need the device online; auto-reply cannot honor STOP on a dead phone.
Signatures are not optional
Verify X-SmsGateway-Signature (or the current header in docs) with the secret you stored server-side. Reject unsigned bodies. Rotate the secret on staff change. HTTPS only. Do not log the raw secret next to the payload.
PHP and C# pages on this site are HTTPS/JSON samples, not a packaged SDK: PHP samples, C# samples.
Failure modes
| Symptom | Likely cause | First move |
|---|---|---|
| No callbacks at all | URL unreachable, TLS, or webhook not registered | Hit the URL yourself; check cert chain |
| Duplicates | Retries + at-least-once delivery | Idempotency key = message id + event type |
| SMS arrived, no DLR event | Operator omitted DLR | Canary; do not auto-resend OTP |
| Events late overnight | Phone Doze / offline | Battery exemptions |
| Inbound STOP missed | Device offline when the reply landed | Spare phone; merge blacklist later |
OTP and idempotency
Your app owns expiry and resend. A webhook timeout is not permission to mint a second code. Store the challenge id. See OTP verification and the OTP in-depth guide.
When the phone is the bottleneck
Webhooks fire from the control plane as the device reports. If the handset is asleep, your server stays quiet. Alert on device heartbeat, not only on missing DLR. Offline alerts. Multi-device: dual SIM / multi-device.
Cost
Callbacks are not a separate SKU. Sends still spend operator credit. Platform volume still meters. We do not sell aggregator per-message credits. See pricing.
Checklist
- HTTPS endpoint, signature verified.
- Idempotent handler.
- Secrets not in git.
- OTP isolated; no DLR-only resend.
- Heartbeat alert beside webhook metrics.
Next steps
Product page webhooks, DLR, setup. App spoke for logs: log export.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS webhook integrationInbound and status events
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- SMS API documentationLive endpoint reference
