Why a webhook
Polling the API works, but a webhook delivers each SMS within seconds without your code asking again and again.
Set it up
Open the API key page, enter an HTTPS address on a public domain and save. The signing secret is shown once: store it with your server's other secrets.
What you receive
A POST with a JSON body: event sms.received and data with the rental id, phone number, sender, full text, the detected code and the time received.
Verify every request
Read the X-PortSMS-Signature header, compute HMAC-SHA256 of "t.body" with your secret and compare it with v1 in constant time. Reject requests whose t is more than 5 minutes old.
Answer quickly
Reply with a 2xx status as soon as you have stored the message, and do slow work afterwards. Anything else is retried up to 8 times.