Secure SMS Webhook
Open source · Security first

Know who sent
your SMS webhook.

Verify provider signatures, reject stale or replayed events, validate SMS payloads, and redact sensitive logs before your application trusts a request.

Generate secure example npm i secure-sms-webhook
✓ No runtime dependencies ✓ Local defensive CLI ✓ MIT licensed
security-report

$ npx secure-sms-webhook test

Target http://127.0.0.1:3000/webhooks/sms

✓ Missing signature rejected

✓ Invalid signature rejected

✓ Valid signature accepted

✗ Replay request processed twice

✓ Invalid phone number rejected

! Payload size limit not observed

CRITICAL Duplicate side effect detected

Use an atomic event-ID claim before processing.

Signature verification Replay protection Timestamp policy PII redaction
Secure example generator

Start with safer defaults.

This browser tool generates code only. It never asks for, stores, or transmits provider secrets.

Security configuration

● Runs entirely in your browser. Use environment variables for real secrets.

Node.js · Twilio
Provider-aware

One policy layer. Different cryptography.

Tw

Twilio

Exact URL, form parameters, raw JSON body hashes, and HMAC-SHA1 compatibility.

Tx

Telnyx

Ed25519 public-key verification over a timestamped raw JSON payload.

Vo

Vonage

Signed SMS callbacks with HMAC-SHA256 recommended and MD5 migration warnings.

Pl

Plivo

V3 HMAC-SHA256 validation with nonce-aware replay controls.

H

Generic HMAC

Configurable hash, encoding, prefix, timestamp separator, and event IDs for private providers and internal APIs.

Defensive by design

Security signals that
survive real scrutiny.

The project documents trust boundaries instead of promising perfect security. Every supported provider receives protocol-specific tests and a consistent result model.

  • 01Constant-time comparisonShared-secret signatures are decoded before timing-safe byte comparison.
  • 02Atomic replay contractProduction stores claim each event only once across concurrent workers.
  • 03Raw-body integritySignatures are checked before payload normalization or redaction changes bytes.
  • 04Responsible disclosureA public security policy provides a private path to report vulnerabilities.
Non-sensitive testing resource

Testing outbound US SMS delivery?

Developers may inspect non-sensitive delivery using a public US inbox. Public messages are visible to other people—never use public numbers for passwords, OTPs, banking, private accounts, or confidential information.

Maintainer disclosure: Secure SMS Webhook and Receive SMS Live are maintained by the same team. This outbound delivery resource does not test an inbound webhook.

Receive SMS Live — US ↗