Endpoint setup & permissions

Create your webhook endpoint in Account Settings → Integrations / CRM & webhooks. The signing secret is shown once when the endpoint is created or rotated. If you no longer have it, rotate the secret and update your application.

Account owners can grant Settings: Account webhooks to trusted agents. This permission manages endpoints, signing secrets and delivery logs for the whole account; CRM permission alone does not grant webhook access.

For separate environments, create an endpoint for each environment and select its SMS Sender IDs. All Sender IDs receives every subscribed SMS event for the account; Selected receives only matching original message.from values. Other event types are unaffected. Multiple matching endpoints each receive the event, so do not select All on an endpoint that must remain isolated.

Selections are checked before each delivery attempt, including retries. Changing a selection does not replay old events or redirect queued deliveries. A request already admitted for delivery may finish. Receivers should still deduplicate by event ID.

Allowlist our outbound delivery IPs in your firewall: 142.132.167.209, 178.105.240.11. Verify webhook signatures with HMAC SHA-256 using your webhook secret and the raw request body.