Key Takeaways
- An Android SMS gateway HTTPS webhook is TLS to your endpoint plus a signature — HTTP is not “good enough for staging.”
- Expired certs look like a radio outage. They are not.
- Verify HMAC even on HTTPS. TLS stops the path; it does not prove the sender.
- Idempotent handlers. Retries will happen.
- Device Doze can delay events while TLS is perfect.
- Live header names live in Developer Center.
HTTPS is the floor
Android SMS gateway HTTPS webhook setup is the TLS half of callbacks: delivery and inbound events POST to a URL you control. HTTP in production is a gift to anyone who can sit on the path. Even staging should be HTTPS if it ever sees real MSISDNs.
The SIM path still spends your operator credit. We meter devices and platform SMS volume. Webhooks are not a paid SMS pack. Free 300 lifetime / Developer 25,000 a year still apply to sends, not to how pretty your certificate is.
“TLS without signature checks is a private road with no gate. Anyone who can POST still walks in.”
Certificates and ciphers
Public CA, auto-renew (Let’s Encrypt or your cloud load balancer), no expired intermediates. Pinning is optional and easy to get wrong — prefer CA validation plus HMAC. Follow current TLS guidance from Mozilla SSL Configuration Generator; do not freeze TLS 1.0 “because the phone is old.” The phone talks to our control plane; your webhook server talks to the internet.
Product page: webhook integration. Live fields: Developer Center. Samples are HTTPS/JSON, not an SDK: PHP, C#.
What breaks callbacks
| Symptom | Often | Not |
|---|---|---|
| Sudden 0 callbacks | Cert expired, DNS cutover, WAF 403 | “SIM empty” |
| Intermittent 502 | Your app crash / timeout < 5s | Need to resend all OTP |
| Events hours late | Device offline / Doze | TLS version |
| Unsigned bodies accepted | You skipped HMAC | HTTPS magically authenticates |
HMAC over TLS
Verify the signature header from docs. Constant-time compare. Reject the rest. Rotate secrets. Do not log them next to payloads. Idempotency on message id + event type — TLS retries and our retries both exist.
Companion: app webhook in-depth.
Phone still has to be awake
Perfect nginx will not wake a Doze-killed gateway. Battery, offline alerts.
Cost
Certificates are cheap; incidents are not. Sends still bill airtime + platform volume. Pricing.
Checklist
- HTTPS only; redirect HTTP if it must exist.
- Cert auto-renew tested.
- HMAC verified.
- Idempotent handler.
- Heartbeat alert independent of webhook graphs.
Next steps
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS webhook integrationInbound and status events
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- SMS API documentationLive endpoint reference
