Receiving Messages

You don’t set up a carrier webhook — MOST does

Unlike raw Twilio/Telnyx, you never configure a provider webhook for inbound SMS. When MOST provisions your number, it automatically points the carrier’s inbound webhook at MOST (the Telnyx messaging profile’s webhook_url is set to MOST’s handler). Every text sent to your number is captured for you — no setup, no endpoint to maintain.

Where inbound lands

• Inbound SMS & DMs appear in your Communications inbox in the dashboard, recorded against the matching contact.
• Inbound email to your brand address (hello@yourdomain) is received and forwarded to the account owner, and stored in your inbox.

Get inbound delivered to your webhook

To receive incoming messages in your own system, add a webhook in Settings → General → Incoming Message Webhooks. Every inbound message is then POSTed to your URL as a signed JSON event.

Events

• message.received — an inbound SMS
• email.received — an inbound email to your brand address
• test.ping — sent by the “Send test” button

Payload

POST https://your-app.com/webhooks/most
Content-Type: application/json
X-Most-Event: message.received
X-Most-Delivery: 6f1e…            # unique per delivery
X-Most-Signature: 9a3b…           # HMAC-SHA256(body, your secret), hex

{
  "id": "6f1e…",
  "event": "message.received",
  "created_at": "2026-07-01T21:40:00.000Z",
  "data": {
    "channel": "sms",
    "from": "+15551234567",
    "to": "+15557654321",
    "body": "Do you have this in size M?",
    "contact_id": "c1a2b3c4-…",
    "provider": "telnyx"
  }
}

Verify the signature

Compute HMAC-SHA256 of the raw request body with your endpoint’s signing secret and compare (constant-time) to the X-Most-Signature header:

import crypto from 'crypto'

function verify(rawBody, signature, secret) {
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex')
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
}

Respond with a 2xx to acknowledge. Non-2xx or a timeout is retried with exponential backoff (5 attempts); an endpoint that keeps failing is auto-disabled and can be re-enabled in Settings.

Or react inside MOST

Prefer not to run your own server? Build a workflow to auto-reply, tag, or start a sequence on inbound activity — see workflow webhooks.