Key Takeaways
- COD webhooks are cash-on-delivery confirm: amount and last-four — never a collector PIN or full address dump in SMS.
- Verify signatures before the SIM fires. A replayed cod.confirmed is a second collection attempt.
- Keep checkout OTP off the tablet that dumps evening COD bursts.
- Service pricing is devices plus SMS send volume. You bring the Android phone and operator credit.
- Free is 1 device, 300 SMS lifetime, 300 contacts. Developer is 25,000 SMS per year.
- Idempotency on COD attempt id, not on “order + today.”
Summary
Ecommerce webhooks in scenario 529 are cash-on-delivery confirm and retry: amount, window, order last-four. Unlike order.paid, restock/cart, refund, subscription renew, gift-card, BOPIS, split-shipment, or RMA labels, this event is cash at the door.
Service pricing is devices plus SMS send volume. You bring the Android phone and operator SMS credit. Free is 1 device, 300 SMS lifetime, 300 contacts. Developer is 25,000 SMS per year. Starter, Professional, and Business list Unlimited SMS as platform send volume; devices and airtime stay metered.
A collector PIN in SMS is a theft you scheduled. Verify the webhook. Send amount and window. Keep the code in the app.
Key takeaways
- COD webhooks are cash-on-delivery confirm: amount and last-four — never a collector PIN or full address dump in SMS.
- Verify signatures before the SIM fires. A replayed cod.confirmed is a second collection attempt.
- Keep checkout OTP off the tablet that dumps evening COD bursts.
- Service pricing is devices plus SMS send volume. You bring the Android phone and operator credit.
- Free is 1 device, 300 SMS lifetime, 300 contacts. Developer is 25,000 SMS per year.
- Idempotency on COD attempt id, not on “order + today.”
Related reading
Start from Twilio vs Android SMS gateway, compare device and SMS volume pricing, open device setup, and review BIS cash-handling notes where they apply.
Context
City ops land here after a replayed cod.confirmed sent two riders to the same door. Checkout OTP cannot share that evening burst.
Core scenario guidance
Verify signatures. Idempotency on attempt id. Template: amount, window, last-four. PIN in the app. Isolate OTP. Cap retries.
| Event | SMS body | Fail closed |
|---|---|---|
| cod.confirm | Amount + window + last-four | Collector PIN in body |
| cod.retry | New window | Replay of confirm |
| Idempotency | Attempt id | Order id only |
| Checkout OTP | Separate device | Same SIM as COD burst |
Canary a staff COD after OS updates. MCP wraps REST. Developer Center owns fields.
Cost and ownership
Devices + volume + operator airtime on every replay. Developer is 25,000 SMS per year. Free (1 / 300 / 300) proves pairing, not a city fleet.
Operations
Daily last-seen, battery, webhook fail, duplicate attempt ids. After SIM reseat, one staff COD. On-call before unattended evening peaks.
Security and compliance
COD events reveal that cash will be at a door. Encrypt at rest. Rotate webhook secrets. Never log collector PINs. Verify TLS on every callback.
Decision guide
Ship when signatures, attempt-id idempotency, and PIN isolation exist. Delay if the shop can replay confirm. If zero phone ops is mandatory, evaluate CPaaS for that slice.
Checklist
- Webhook signatures verified.
- Attempt id idempotent.
- No collector PIN in SMS.
- OTP isolated.
- Spare paired.
Next steps
Return to open-source Android SMS gateway, compare device and SMS volume pricing, open device setup, and confirm APIs in SMS API documentation.
Deep dive: production hardening
Webhook signature verification is non-negotiable. Dual-SIM city tablets fail when the send slot swaps after reboot. Battery exemptions dominate overnight hubs.
Deep dive: scaling and failure modes
Scale is COD attempts, not one blast per order. Never claim unlimited free cloud SMS credits with no device or volume meter.
Deep dive: integration discipline
Developer Center owns live API parameters. Persist attempt id. MCP is a REST wrapper. If zero phone ops is mandatory, evaluate CPaaS. You bring the Android phone and operator credit.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS webhook integrationInbound and status events
- transactional SMS for orders and alertsEvent-driven messages
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
