Docs·Webhooks
🪝

Webhooks

Receive activations, rentals, and wallet events as HTTPS callbacks with HMAC signing.

Why webhooks

Polling for inbound SMS is wasteful — sub-second polling is rate-limited, multi-second polling adds latency. Webhooks push events to you the instant they happen.

Register

Account → Webhooks → New endpoint: HTTPS URL, event types, retry strategy (exponential / linear / none). The signing secret is shown once.

Events

  • activation.sms_received — inbound SMS matched to an activation
  • activation.expired — window closed without code
  • activation.finished — activation confirmed
  • rent.sms_received — inbound SMS on a rental
  • wallet.credited / wallet.debited — money movement
  • support.message.received — agent reply in a support thread

Payload

{
  "event": "activation.sms_received",
  "delivery_id": "b7e2c1a0-9f3d-4c5e-8a1b-2d3e4f5a6b7c",
  "created_at": "2026-05-26T14:30:14Z",
  "data": { "order_id": "9a1f2c3d-4e5b-6a7c-8d9e-0f1a2b3c4d5e", "phone": "+380635551822", "code": "123456", "service": "telegram" }
}

Verify signature

Headers: X-Eveses-Signature: sha256=<hmac> and X-Eveses-Timestamp: <ts> (also X-Eveses-Event / X-Eveses-Delivery). The HMAC-SHA256 is computed over <ts>.<raw-body> with your signing secret.

$ts  = $_SERVER['HTTP_X_EVESES_TIMESTAMP'] ?? '';
$sig = $_SERVER['HTTP_X_EVESES_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $ts . '.' . file_get_contents('php://input'), $secret);
if (!hash_equals($expected, $sig) || abs(time() - (int) $ts) > 300) { http_response_code(401); exit; }

Reject anything older than 5 minutes (replay window).

Retries

Failed deliveries (non-2xx or no response in 10s) retry per strategy. Exponential: 30s, 2min, 10min, 1h, 6h, then dead. Manual replay from dashboard.

← PreviousRentalsNext →Wallet & Deposits