Stop Polling: Receive OTP Codes Instantly with OtpGet Webhooks

Polling getStatus every few seconds works, but it wastes requests and adds delay. With a webhook, OtpGet calls your server the moment a code arrives. Faster for your users, lighter for your infrastructure.

How it works

1. You register your HTTPS webhook URL in your API settings.
2. You buy a number as usual.
3. When an SMS arrives, OtpGet sends an HTTP POST to your URL with the order id, the code and the message text.
4. Your server answers with any 2xx status and processes the code.

Always verify the signature

Anyone can send a POST to your URL. To prove a call really came from OtpGet, each request carries a signature header: the HMAC-SHA256 of the raw request body, created with your webhook secret. Compare it before you trust the data:

<?php
$body   = file_get_contents('php://input');
$expect = 'sha256=' . hash_hmac('sha256', $body, $secret);
$given  = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
if (!hash_equals($expect, $given)) { http_response_code(401); exit; }

Use a constant-time comparison such as hash_equals, and hash the raw body, not a re-encoded copy of it.

Delivery rules you should know

• Reply with a 2xx status within a few seconds.
• If you do not, we retry a few times with short gaps.
• The same message can very rarely arrive twice. Treat the order id plus the code as idempotent.
• If an order receives a second SMS, you get a second POST with the new code.
• Only HTTPS URLs are accepted, redirects are not followed, and private or local addresses are rejected.

Keep polling as a safety net

Production systems often use both: webhooks for speed and a slow getStatus check as a fallback in case your server was briefly down. It costs little and removes the last failure mode.

Start building with OtpGet

Create a free account at otpget.com, copy your API key from the dashboard and open the API documentation. Our support team is available 24/7 if you get stuck.