Key Takeaways
- Loyalty-expiry webhooks are points and last-four — never a raw loyalty token in SMS.
- Verify signatures before the SIM fires. A replayed loyalty.points_expire is a second nag.
- Keep checkout OTP off the CX tablet that dumps expiry bursts.
- Service pricing is devices plus SMS send volume. You bring the Android phone and operator credit.
- Free is 1 device, 300 SMS lifetime, 300 contacts. Developer is 25,000 SMS per year.
- Honor STOP. Expiry nags are promotional even when the ledger looks transactional.
Summary
Ecommerce webhooks in scenario 829 are loyalty points expiring: point count, last-four, portal. Unlike order.paid, restock, refund, subscription, gift-card, BOPIS, split-shipment, RMA labels, COD, preorder drop, price-match credit, remaining-line ships, or warranty registration, this event is a CX nag on a promotional lane.
Service pricing is devices plus SMS send volume. You bring the Android phone and operator SMS credit. Free is 1 device, 300 SMS lifetime, 300 contacts. Developer is 25,000 SMS per year. Starter, Professional, and Business list Unlimited SMS as platform send volume; devices and airtime stay metered.
A loyalty token in SMS is account access you leaked. Verify the webhook. Honor STOP. Send points and last-four. Keep the token in the app.
Key takeaways
- Loyalty-expiry webhooks are points and last-four — never a raw loyalty token in SMS.
- Verify signatures before the SIM fires. A replayed loyalty.points_expire is a second nag.
- Keep checkout OTP off the CX tablet that dumps expiry bursts.
- Service pricing is devices plus SMS send volume. You bring the Android phone and operator credit.
- Free is 1 device, 300 SMS lifetime, 300 contacts. Developer is 25,000 SMS per year.
- Honor STOP. Expiry nags are promotional even when the ledger looks transactional.
Related reading
Start from Twilio vs Android SMS gateway, compare device and SMS volume pricing, open device setup, and review FTC advertising notes where they apply.
Context
CX desks land here after a replayed loyalty.points_expire nagged twice, or after a STOP was ignored because “points are transactional.” Checkout OTP cannot share that burst.
Core scenario guidance
Verify signatures. Honor STOP. Idempotency on expiry-batch id. Template: points, last-four. Token in the app. Isolate OTP.
| Event | SMS body | Fail closed |
|---|---|---|
| loyalty.points_expire | Points + last-four | Raw loyalty token |
| STOP | Honor | “Transactional” excuse |
| Idempotency | Expiry-batch id | Member + today |
| Checkout OTP | Separate device | Same SIM as CX burst |
Canary a staff expiry after OS updates. MCP wraps REST. Developer Center owns fields.
Cost and ownership
Devices + volume + operator airtime on every replay. Developer is 25,000 SMS per year. Free (1 / 300 / 300) proves pairing, not a CX desk.
Operations
Daily last-seen, battery, webhook fail, STOP miss, duplicate expiry-batch ids. After SIM reseat, one staff nag. On-call before unattended expiry weekends.
Security and compliance
Loyalty events reveal balances. Encrypt at rest. Rotate webhook secrets. Never log tokens. Verify TLS on every callback.
Decision guide
Ship when signatures, STOP honor, and token isolation exist. Delay if expiry nags ignore mute. If zero phone ops is mandatory, evaluate CPaaS for that slice.
Checklist
- Webhook signatures verified.
- STOP honored.
- No loyalty token in SMS.
- OTP isolated.
- Spare paired.
Next steps
Return to Android SMS gateway API guide, compare device and SMS volume pricing, open device setup, and confirm APIs in SMS API documentation.
Deep dive: production hardening
Webhook signature verification is non-negotiable. Dual-SIM CX tablets fail when the send slot swaps after reboot. Battery exemptions dominate overnight desks.
Deep dive: scaling and failure modes
Scale is members times expiry events, not a blast of the catalog. Never claim unlimited free cloud SMS credits with no device or volume meter.
Deep dive: integration discipline
Developer Center owns live API parameters. Persist expiry-batch id. MCP is a REST wrapper. If zero phone ops is mandatory, evaluate CPaaS. You bring the Android phone and operator credit.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS webhook integrationInbound and status events
- transactional SMS for orders and alertsEvent-driven messages
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
