Webhooks

Parse and optionally verify an incoming delivery event. The signature is an HMAC-SHA256 hex digest of the raw body in the X-SendAfrica-Signature header.

from flask import request, jsonify
 
@app.route("/webhooks/sms", methods=["POST"])
def handle_webhook():
    payload = request.get_data(as_text=True)
    signature = request.headers.get("X-SendAfrica-Signature", "")
 
    try:
        event = client.webhooks.parse(payload, signature=signature)
    except Exception:
        return jsonify(error="invalid signature"), 401
 
    print(event.type, event.message_id, event.data)
    return jsonify(ok=True), 200

When a webhook_secret was provided at client construction, passing secret= to parse is optional. You can verify a raw payload without parsing with:

client.webhooks._verify_signature(raw_body, signature, secret)

Correct response semantics

• Return 2xx only after the event is durably processed — the handler above writes no state before returning, so make yours e.g. commit to a DB before the 200.
• Ack fast, process heavy work asynchronously.
• Deduplicate on (message_id, event) — retries can deliver duplicates.

See Webhooks for the full contract, retry backoff, and endpoint-management API.