Key Takeaways
- Node.js receives Android SMS gateway webhooks over HTTPS — plain REST callbacks, not a Complete Node SDK.
- Verify signatures, ack fast, process in a queue; idempotent upserts by message ID.
- Inbound SMS and DLR are different events — do not mark delivered on send response alone.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Free is 300 SMS lifetime; paid from $19/month.
- Never log full OTP bodies from webhook payloads.
- Confirm live webhook fields in Developer Center.
Summary
This guide covers Node.js receive webhook patterns for an Android SMS gateway API: DLR and inbound SMS into your Node service via REST HTTPS. Hub: Android SMS Gateway API. Priced by devices and SMS send volume. You use your own phone and operator SMS credit.
If your webhook route is unauthenticated and writes “delivered” into the OTP table, anyone on the internet can approve logins. Signatures first — side effects second.
What receive webhooks do
After you send via REST, the gateway may POST status or inbound messages to your URL. Handlers verify authenticity, enqueue jobs, and update records. Field shapes: SMS API documentation. Product surface: webhook integration.
Handler checklist table
| Check | Pass | Fail |
|---|---|---|
| Auth | Signature / secret OK | Open POST endpoint |
| Latency | Ack < few hundred ms | DB work inline |
| Idempotency | Upsert by message ID | Duplicate side effects |
| Privacy | OTP redacted in logs | Bodies in stdout |
Node implementation shape
- Express/Fastify route dedicated to webhooks.
- Verify signature before JSON parse side effects.
- Push to BullMQ/Rabbit/SQS; return 2xx.
- Worker updates OTP/campaign state; handles STOP keywords on inbound.
- Canary with staff numbers after deploy.
Security
TLS only. Secrets in ENV. Rotate on staff change. Do not expose raw payloads to browser clients. Pair devices via setup.
Cost
Free is 300 SMS lifetime; paid from $19/month. See pricing.
Checklist
- REST webhooks — no Complete Node SDK claims.
- Signed, fast ack, queued, idempotent, redacted.
- OTP pool isolated; canary passed.
Next steps
Confirm fields in the SMS API documentation and keep accept ≠ delivered in your domain model.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS webhook integrationInbound and status events
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
