Authorization: Bearer rk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

const API = 'https://rentalnumbers.com/functions/resellerApi';

const call = (endpoint, params = {}) =>
  fetch(API, { method: 'POST', headers, body: JSON.stringify({ endpoint, ...params }) })
    .then(r => r.json());

// 1. Fetch valid countries for the server you want
const { countries } = await call('listCountries', { server: 3 });

// 2. Fetch service catalog
const { services } = await call('listServices', { server: 3, country: 'United Kingdom' });

// 3. Confirm price + availability before renting
const price = await call('checkPrice', { country: 'United Kingdom', service: 'WhatsApp', server: 3 });
// → { success: true, price: 0.45, available: 124 }

X-RentalNumbers-Event: sms.received
X-RentalNumbers-Signature: sha256=<hex>
Content-Type: application/json

// Node.js — verify incoming webhook
const crypto = require('crypto');
const SECRET = process.env.RENTALNUMBERS_WEBHOOK_SECRET; // whsec_...

app.post('/rentalnumbers-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.header('X-RentalNumbers-Signature') || '';
  const expected = 'sha256=' + crypto.createHmac('sha256', SECRET)
    .update(req.body).digest('hex');
  if (sig !== expected) return res.status(401).send('bad signature');

  const event = JSON.parse(req.body.toString());
  // event.event = "sms.received" | "rental.expired" | "rental.cancelled"
  // event.data = { rental_id, phone_number, sms?, ... }
  console.log('Webhook:', event.event, event.data);
  res.sendStatus(200);
});