Webhook HMAC Signature Verification

import hmac, hashlib

def verify_smsriver_signature(secret: str, signature: str, raw_body: bytes) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

import crypto from "crypto";

export function verifySignature(secret: string, signature: string, rawBody: Buffer): boolean {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Ensure your web framework does not parse or modify the raw bytes before computing the cryptographic hash.

Retrieve the `X-SMSRiver-Signature` or `X-Twilio-Signature` header from the incoming HTTP request.

Always use `hmac.compare_digest` or `crypto.timingSafeEqual` to prevent timing attacks.

Discover supported countries, inventory counts, and carrier capabilities by source type.

Check line types, SMS capabilities, carrier limitations, and rental costs for a phone number or ISO country.

Create an isolated synthetic test inbox for deterministic webhook integration testing without real carriers.

Inject zero-carrier-cost synthetic SMS inbound events directly into webhook endpoints for CI/CD test automation.

Simulate carrier drops, 10DLC rejections, DND blocks, and queue timeouts to verify retry handling.

Query recorded test events, delivery status, latency, and raw carrier webhook payloads within plan retention.

Replay an existing test event to re-trigger local webhooks or reproduce failed integration test cases.

Inspect current billing plan, monthly quota, consumed requests, and remaining units across REST and MCP.