Programmable SMS that fits your stack.
Two-way SMS over REST, HMAC-signed webhooks, deep links and a contacts API — with short-lived JWT sessions, multi-device revocation, automatic TCPA opt-out and multi-tenant separation. Drive VanceTel from your own software instead of bolting on another silo.
import crypto from "node:crypto"
function verify(rawBody, header, secret) {
// Header: t=1748700343,v1=9f86d0818...
const [t, v1] = header.split(",").map((p) => p.split("=")[1])
const expected = crypto
.createHmac("sha256", secret)
.update(`${t}.${rawBody}`)
.digest("hex")
return crypto.timingSafeEqual(
Buffer.from(v1),
Buffer.from(expected),
)
}Verify the HMAC before you trust the event.
Messaging primitives your platform can own.
Wire VanceTel into the systems your team already runs. Signed events in, deep links out, contacts in sync — separated cleanly per tenant.
HMAC-signed webhooks
Inbound messages, delivery receipts and call events post to your endpoint, each HMAC-SHA256 signed. Verify the signature before you trust the payload — no shared-secret guesswork.
Learn moreDeep links into the softphone
Launch a call or a pre-addressed text from any internal tool, ticket or dashboard with a deep link. The softphone opens with the recipient pre-filled and ready to go.
Learn moreContacts API
Create and sync contacts programmatically so directory data stays current. Caller-ID resolution surfaces the right identity on the next inbound call across the team.
Learn moreMulti-tenant by design
Keep numbers, contacts and conversations separated per tenant or business unit. Drive each tenant from the same API without leaking data across boundaries.
Learn moreControls IT teams ask for first.
Short-lived JWT sessions
Device sessions use short-lived JWTs that rotate, so a leaked token has a narrow blast radius rather than standing access.
Multi-device session revocation
Revoke a session and the device is signed out everywhere it is paired — useful for offboarding or a lost device.
Automatic TCPA opt-out
STOP, START and HELP are intercepted and honored automatically. A send to an opted-out number is rejected before it leaves.
Signed, verifiable events
Every webhook is HMAC-SHA256 signed. Your endpoint verifies origin and integrity before acting on an event.
Sync contacts, resolve callers.
Push contact records from your source of truth with a tenant id and tags. VanceTel keeps the shared directory current and resolves caller-ID on the next inbound call.
- Per-tenant separation on every record
- Caller-ID resolution surfaces the right identity
- Pair with the contacts API for full sync flows
curl https://api.netexem.com/v1/contacts \
-H "Authorization: Bearer $NETEXEM_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Dana Reyes",
"phone": "+15557654321",
"email": "dana@northwind.com",
"company": "Northwind"
}'One messaging layer across the org.
Two-way SMS from internal systems
Trigger alerts, confirmations and on-call notifications from your own services. Replies arrive as signed webhooks and land in the softphone for a human to pick up.
Deep links from your tools
Embed click-to-call and click-to-text links in tickets, runbooks and dashboards. Staff act from the softphone without copy-pasting numbers between systems.
One messaging layer, many tenants
Run separate business units or customers on isolated numbers and contacts through one API — no second silo to administer or secure.
How are webhooks secured?
Every VanceTel webhook is signed with HMAC-SHA256. The payload carries a timestamp and a signature header; your endpoint recomputes the HMAC with your signing secret and compares it in constant time before acting. That lets you verify both the origin and the integrity of each event.
How do sessions and revocation work?
Device sessions use short-lived JWTs that rotate rather than long-standing credentials. You can revoke a session and have the device signed out across everywhere it is paired, which is what you want for offboarding, a lost device, or a suspected compromise.
Is opt-out compliance handled for us?
Yes. VanceTel intercepts STOP, START and HELP automatically and tracks each recipient’s opt-out state. A message to an opted-out number is rejected before it sends, so TCPA consent management is part of the platform rather than something your team builds and maintains.
Can we run this multi-tenant?
Yes. Numbers, contacts and conversations can be separated per tenant or business unit and driven from the same REST API, so data stays inside its boundary while you administer one integration instead of many.
What does the contacts API cover?
The contacts API lets you create and sync contact records programmatically — name, phone and tags — so your directory stays current. On the next inbound call, caller-ID resolution surfaces the matching contact to the team. The public API is write-and-event oriented, paired with webhooks for inbound activity.
Bring messaging into your stack — securely.
Two-way SMS, signed webhooks, deep links and a contacts API — with short-lived sessions, revocation and multi-tenant separation built into VanceTel.