Webhooks

Tecron posts signed JSON to your HTTPS callback when message status (and related) events occur.

Secret

Configure a webhook secret in the dashboard. Examples below use YOUR_WEBHOOK_SECRET — never commit a real whsec_ value.

Signature headers

Verify the exact raw request body bytes. The signature header uses timestamp and versioned digests:

• t= — unix timestamp (seconds)
• v1= — HMAC-SHA256 hex of the signed payload
• v0= — legacy/alternate digest when present

Reject requests whose timestamp is too old (replay window) or whose HMAC does not match.

Pseudocode

raw = request.bodyBytes  // do not re-serialize JSON
secret = YOUR_WEBHOOK_SECRET
parse header → t, v1
signed = t + "." + raw
expected = hex(HMAC_SHA256(secret, signed))
constant_time_compare(expected, v1)

Callback URL on send

Optional callbackUrl on template/session accept overrides the account webhook for that message’s status callbacks. It must be HTTPS and SSRF-safe; signing still uses the account secret.

Payload shape

See WebhookEventPayload in the API reference.