Which iMessage API is best for Node.js?

Ranked by what a Node codebase needs

Do not reach for an SDK by default

These are small REST APIs — send, status, webhook. A hand-written client has no supply chain and does not go stale when a vendor stops publishing releases. Check any provider SDK's last npm publish date before depending on it; in this category a package quiet for two years is common and is a warning.

The client

export async function sendMessage(input: { to: string; body: string }) {
  const response = await fetch("https://api.sendblue.co/api/send-message", {
    method: "POST",
    headers: {
      "sb-api-key-id": process.env.IMESSAGE_KEY_ID!,
      "sb-api-secret-key": process.env.IMESSAGE_SECRET!,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ number: input.to, content: input.body }),
    // Without this, a hung provider hangs your request handler with it.
    signal: AbortSignal.timeout(10_000),
  });

  if (!response.ok) {
    const retryable = response.status === 429 || response.status >= 500;
    throw new ImessageError(await response.text(), response.status, retryable);
  }
  return response.json();
}

The full Node.js guide — retries, Express webhook, send queue.

The four failure modes, in order of likelihood

The send queue

export async function drain(jobs: Job[], opts: { perMinute: number; dailyCap: number }) {
  const spacingMs = 60_000 / opts.perMinute;

  for (const job of jobs.slice(0, opts.dailyCap)) {
    const startedAt = Date.now();
    try {
      await sendWithRetry(job);
    } catch (error) {
      // One bad recipient must not stop the run.
      console.error("send failed", job.to, error);
    }
    const elapsed = Date.now() - startedAt;
    // Jitter: perfectly regular intervals are a machine fingerprint.
    const wait = spacingMs - elapsed + Math.random() * spacingMs * 0.3;
    if (wait > 0) await new Promise((r) => setTimeout(r, wait));
  }
}

The full Node.js guide and what reliability actually means here.

Security: the mistake that matters most

Verifying the webhook properly

import crypto from "node:crypto";

function verify(raw: Buffer, header: string | undefined): boolean {
  if (!header) return false;

  const expected = crypto
    .createHmac("sha256", process.env.IMESSAGE_WEBHOOK_SECRET!)
    .update(raw)
    .digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(header);
  // Length check first: timingSafeEqual throws on a length mismatch.
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

The three rules

1. 1Verify before you parse. Computing the HMAC over re-serialized JSON fails every time, because key order and whitespace differ from what was signed. The failure looks like a wrong secret, and the usual 'fix' is to stop checking.
2. 2Use a constant-time comparison. A plain === leaks the signature one byte at a time to anyone patient enough to measure.
3. 3Check the timestamp. A signature alone lets an attacker replay a captured request forever; a five-minute window closes that.

What it costs

Where saving money costs more

• Skipping fallback. Roughly half your recipients may be on Android. A provider without SMS fallback means those messages simply fail, and you build the routing yourself.
• A shared number for a brand-facing use case. If customers should save you as a contact, a pooled number defeats the purpose.
• Under-provisioning lines. Pushing one line past its safe daily ceiling to avoid buying a second is how lines get flagged — and a flagged line costs far more than $100. Pacing.

The full pricing comparison and the per-line arithmetic.

The documentation checklist

Five of six is normal in this category. Fewer than four and you are buying a service you cannot assess until you are already dependent on it.

Trust signals that are worth less than they look

• A SOC 2 badge without the report. Ask for the Type II report under NDA and check the period and scope. What it does and does not cover.
• Accelerator affiliation. Tells you a company raised money, not that your line stays delivering.
• Logos on a homepage. Unverifiable, and standard practice regardless of the relationship.
• "Enterprise-grade" or "carrier-grade". Neither term has a definition.

The documentation comparison.

Tooling worth adding

Replaying a webhook fixture

SECRET="$IMESSAGE_WEBHOOK_SECRET"
BODY=$(cat fixtures/inbound-message.json)
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $2}')

curl -sS -X POST http://localhost:3000/webhooks/imessage \\
  -H "Content-Type: application/json" \\
  -H "x-signature: $SIG" \\
  --data-raw "$BODY"

The full Node.js guide and the developer hub.

What changed between 2025 and 2026

• Node needs less from you now. fetch, AbortSignal.timeout and crypto.timingSafeEqual are all built in, so a dependency-free client is genuinely the default rather than a purist choice.
• Agent-first vendors entered with published prices and open SDKs — Photon is the clearest example.
• Compliance became a selling point, though it mostly matters at the enterprise end rather than for a solo Node integration.
• Per-line pricing held, so the cost model you planned around in 2025 still applies.

What did not change

Apple still publishes no API. Lines still have safe daily ceilings. A throttled line still returns 200 OK. The parts of your integration that matter — retries, webhook verification, pacing — are exactly the same ones that mattered a year ago.

The current recommendation with code, and what changed across the category.

The pre-launch checklist

The full inbound guide.