Connecting channels

A channel is one delivery route with its own encrypted credentials. Connect at least one before anything can be routed — Telegram or a webhook is the quickest first channel. Everything here lives under Addons → ImpulseNotify → Channels.

1. What a channel is

A channel pairs one of nine delivery types — WhatsApp, SMS, Telegram, Webhook / n8n, Slack, Discord, Microsoft Teams, Email and Pushover — with the credentials that type needs. You bring your own accounts; no message credits are bundled. You can run several channels of the same type, for example one WhatsApp channel for billing and another for support.

• Credentials are encrypted at rest (AES-256-GCM, keyed to your WHMCS install) and shown masked as •••••••• after saving. A Webhook, Slack, Discord or Teams destination URL counts as a credential too: the form shows only its host.
• Status: a new channel reads unconfigured until its first test send; after that it shows ok or error with a Last test time.
• Instant vs queued: for rule-routed events, Telegram, Webhook, Slack, Discord, Teams and Pushover channels try to send on the same request that raised the event, so messages usually arrive immediately; WhatsApp, SMS and Email wait for the queue, which the 1-minute queue_drain cron task delivers. Manual single sends and WHMCS Notification Provider sends go out immediately on every channel type.
• Dev mode: on an unlicensed install, creating a channel counts toward the 3-channel cap and every test send toward the 50-sends-per-day cap. Disabling, editing and deleting channels always work.

2. Add a channel

1. Go to Addons → ImpulseNotify → Channels.
2. Click Add channel (guided) for the step-by-step wizard, or the manual setup link for a single form. Pick the channel type and give the channel a label.
3. Fill in the credentials. Each field has inline help, and each type has a collapsible setup guide.
4. Finish with a test send: the wizard ends on Test & enable; on the list, use the row’s Test send. A test result shows the provider’s response, with any credential scrubbed out.

A wizard you leave part-way stays on the list as a disabled draft with a Resume setup button.

Editing without re-entering secrets

On the edit form and in the wizard, a secret left masked or blank keeps its stored value, so you can change one field without re-typing the others. Switching an SMS channel to a different provider keeps none of the old provider’s secrets — enter the new provider’s own. A Telegram channel’s webhook secret can’t be cleared; its edit form offers Regenerate webhook secret instead.

3. Telegram — the quickest first channel

Telegram needs no approvals, so it’s the easiest way to prove the pipeline end to end. The guided wizard has four steps.

1. In Telegram, message @BotFather, send /newbot, pick a name and username, and copy the Bot token it issues.
2. In the wizard’s Bot token step, paste the token. The Webhook secret token is a string of 8–256 characters (A-Z a-z 0-9 _ -); leave it blank and the wizard generates one. Saving checks the token with Telegram — you only advance when the bot answers.
3. Find your chat id: bots can’t start conversations, so send your bot any message first (for a group, add the bot and post something), then click Refresh chats and pick the chat. You can also type a chat id; group ids are negative.
4. Test & enable.

Recipients on Telegram are chat ids, not usernames.

Client linking and STOP replies

Your clients can link their own Telegram chat from the client-area preferences page with Connect Telegram, and a linked client can reply STOP to opt out. Both need Telegram to deliver updates to ImpulseNotify, and the module doesn’t register that webhook for you. Register it with Telegram’s setWebhook, using your channel’s ID from the Channels list and its webhook secret as the secret_token:

curl -s "https://api.telegram.org/bot<BOT_TOKEN>/setWebhook" \
  --data-urlencode "url=<your WHMCS System URL>/modules/addons/impulsenotify/callbacks/telegram.php?channel=<CHANNEL_ID>" \
  --data-urlencode "secret_token=<WEBHOOK_SECRET>"

ImpulseNotify refuses any Telegram callback that doesn’t carry the channel’s secret. If the wizard generated the secret, you haven’t seen it: use Regenerate webhook secret on the channel’s edit form, which shows the new one once, then run setWebhook with it straight away. Once a webhook is set, Telegram stops answering the wizard’s Refresh chats lookup, so find your chat ids first.

4. Webhook / n8n

The Webhook channel POSTs a signed JSON body to any public endpoint — an n8n Webhook node, a custom receiver, or another automation platform.

• Destination URL — the endpoint that receives the POST. A rule’s Recipient can override it per rule.
• Signing secret — at least 8 characters. Leave it blank in the wizard and one is generated and shown once, so you can copy it into your receiver.

Every delivery is a JSON POST with the fields event, occurred_at, text, vars and request_id, and three headers:

Header	Value
X-ImpulseNotify-Origin	impulsenotify
X-ImpulseNotify-Timestamp	Unix time of the send
X-ImpulseNotify-Signature	sha256= + hex HMAC-SHA256 of the raw body, keyed with the signing secret

Verify the signature on the receiving side before you trust the body — compute the HMAC over the raw request body and compare in constant time. In an n8n Code node, for example:

const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
const given = headers['x-impulsenotify-signature'] || '';
if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(given))) throw new Error('bad signature');

A Webhook channel needs no message template: rule-routed events arrive with their variables in vars.

Public endpoints only

Every Webhook, Slack, Discord and Teams URL is checked before each request. The host must resolve to a public address on port 80, 443 or 8443; private, loopback, link-local and other reserved ranges are refused, and so is a host that doesn’t resolve. Webhook URLs may be http:// or https://; Slack, Discord and Teams URLs must be https://.

5. Slack, Discord & Microsoft Teams

Each of these takes a single URL, which is the credential and is stored encrypted. A rule’s Recipient can override it per rule.

• Slack — an Incoming webhook URL (Slack app → Incoming Webhooks → Add New Webhook to Workspace).
• Discord — a channel Webhook URL (Channel → Edit → Integrations → Webhooks → New Webhook → Copy URL).
• Microsoft Teams — a Workflow URL: the HTTP POST URL of a Power Automate “When a Teams webhook request is received” workflow. Messages arrive as an Adaptive Card.

6. SMS

SMS runs on your own gateway account, chosen per channel under SMS provider. Only the selected provider’s fields apply:

Provider	Fields	Receipts & STOP
Twilio	Account SID, Auth token, Messaging Service SID or From number	✓
Vonage (Nexmo)	API key, API secret, From, Signature secret (optional), Signature method	✓ — callbacks need the signature secret
Telnyx	API key, From or Messaging Profile ID, Public key	✓ — callbacks need the public key and PHP’s sodium extension
Plivo	Auth ID, Auth token, From	✓
MessageBird / Bird	Access key, From, Signing key	✓
AWS SNS	Access key ID, Secret access key, Region, Sender ID (optional), SMS type	— send-only

• Recipients are normalized to E.164; a number that can’t be normalized fails without retrying. The Diagnostics → Health Checks → Phone-number normalizer shows how a raw number converts.
• Callback URL: once the channel is saved, Diagnostics → Health Checks → SMS callback endpoints lists its URL (…/modules/addons/impulsenotify/callbacks/sms.php?channel=<id>) and where it goes in your provider’s console. Paste it exactly as shown, as an HTTP POST webhook. The one URL takes both delivery receipts and inbound replies. AWS SNS has no inbound webhook — its delivery status goes to Amazon CloudWatch.
• STOP replies: an inbound STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT from a client’s number opts that client out of every category on SMS, with at most one confirmation message per number per day. Two-way replies need a real number, not an alphanumeric sender ID.

Bring your own compliance

SMS runs on your gateway account and agreement. Sender registration (10DLC in the US, sender-ID registration elsewhere), recipient opt-in evidence, content rules and per-market quiet hours are yours to complete with the provider. ImpulseNotify enforces the opt-outs it receives, but it can’t register your senders.

7. Email

Email has one optional field, From name. The provider, from address and SMTP settings live under Settings → Email delivery, which embeds ImpulseCore’s shared Email Delivery panel: leave it unconfigured to inherit your ImpulseCore-wide email settings, or set a provider there to override them for notifications only. With neither configured, email falls back to the WHMCS mailer.

8. Pushover

• Application API token — the 30-character token of your registered Pushover application.
• Default user/group key — used when a rule gives no recipient. A rule can target another user or group key.
• Optional Device(s), Default title, Priority (-2 silent to 1 high), Sound and Time to live. Emergency priority 2 isn’t supported, because it needs acknowledgement tracking.

9. WhatsApp

WhatsApp is the most involved channel. It needs a Meta app, a permanent access token, the app secret and a verified webhook, and every business-initiated message must use a Meta-approved template.

• Fields: App ID, Phone number ID, WhatsApp Business Account ID, Access token, App secret, Webhook verify token.
• The guided wizard has five steps — channel type & label, Meta app credentials (saving checks the token), business account & number discovery, webhook, and test & enable. On the channel list, Auto-configure discovers the IDs, generates the verify token and subscribes the webhook for you.
• Meta verifies the webhook against your server, and ImpulseNotify answers only for an enabled channel. A wizard draft stays disabled until Test & enable, so wire the webhook after enabling — see WhatsApp onboarding.

The full path — the free test number, the permanent token, the app secret, webhook verification and templates — is in WhatsApp onboarding.

10. Channel reference

Type	Fields (secrets stored encrypted)	Delivery receipts	Inbound
WhatsApp	App ID, Phone number ID, WhatsApp Business Account ID, Access token, App secret, Webhook verify token	✓	—
SMS	per provider — see SMS	✓ (not AWS SNS)	STOP replies
Telegram	Bot token, Webhook secret token	—	Client linking, STOP replies
Webhook / n8n	Destination URL, Signing secret	—	—
Slack	Incoming webhook URL	—	—
Discord	Webhook URL	—	—
Microsoft Teams	Workflow URL	—	—
Email	From name	—	—
Pushover	Application API token, Default user/group key, Device(s), Default title, Priority, Sound, Time to live	—	—

Secrets are in bold.