Android SMS Gateway webhooks: Api usage

Searchers for android sms gateway webhooks API usage want the callback contract, not another overview. The pillar is SMS webhook integration. Timeouts: webhook timeout.

Priced by devices and SMS send volume. You use your own phone and operator SMS credit.

If you trust an unsigned JSON POST because it “looks like our DLR,” you have given the internet a write path into order status. Verify HMAC first.

Pillar owns the product story

Live parameters: Developer Center. The phone still radios the SMS; webhooks report what happened after.

Register with POST /webhooks

Bearer, JSON, HTTPS URL you control. No query-string keys. Illustrative delivered payload (shape can drift — docs win):

{
  "id": "evt_01K2F8QW3N4RXB7M",
  "type": "message.delivered",
  "createdAt": "2026-08-12T14:04:09Z",
  "apiVersion": "2026-08-12",
  "data": {
    "message": {
      "id": 41823,
      "number": "+14155552671",
      "text": "Your verification code is 481920",
      "status": "Delivered",
      "campaignId": 17,
      "deviceId": 3,
      "metadata": { "orderId": "1234" },
      "sentAt": "2026-08-12T14:04:02Z",
      "deliveredAt": "2026-08-12T14:04:09Z"
    }
  }
}

Events you actually handle

HMAC on every POST

X-SmsGateway-Signature = v1=hex(HMAC-SHA256("{timestamp}.{body}", secret)). Timestamp header is unix seconds. Reject stale clocks. Dedupe on X-SmsGateway-Event-Id. Sample verify patterns: PHP HTTPS samples— not a packaged SDK.

Ack fast

Enqueue work; return 2xx. Retries duplicate. Send idempotency is a different header.

Do not log OTP bodies

Store message ids. Isolate OTP devices so inbound STOP automation cannot trampoline into auth threads.

Checklist

• URL registered; TLS valid.
• HMAC + timestamp + event id.
• Handler p95 under retry timeout.
• Docs checked the day you freeze.
• Staff canary delivered + received.
• No secrets in Postman team dumps.

Next steps

Pair a phone, then subscribe. Pricing remains devices + volume.