Call the Edesy number masking REST API from PHP with plain HTTP: create a masked session, place a click-to-call and verify signed event webhooks. There is no PHP SDK to install; any HTTP client works.
Number masking at a glance
From API key to first masked call
Sign up at masking.edesy.in, complete KYC and create an API key (it starts with vp_). The full key is shown once, so store it in an environment variable.
Enroll a number from your Edesy account for masking. One number can serve many sessions at once.
POST /v1/masking/sessions with party_a, party_b and your reference, using cURL. Give the returned virtual_number to both parties.
Set your endpoint with PUT /v1/masking/event-webhook and verify the X-Edesy-Signature header before trusting an event.
Create a masked session and verify an event webhook. Replace the numbers with real 10-digit Indian mobiles.
<?php
// PHP 7.4+: plain HTTP with cURL. No SDK or Composer package to install.
$api = "https://voice-api.edesy.in/v1";
$key = getenv("EDESY_API_KEY"); // vp_... from masking.edesy.in
// 1. Create a two-way masked session
$ch = curl_init("$api/masking/sessions");
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Authorization: Bearer $key",
"Content-Type: application/json",
],
CURLOPT_POSTFIELDS => json_encode([
"party_a" => "9876543210",
"party_b" => "9123456789",
"reference" => "ORD-4821",
"expiry_minutes" => 60,
]),
]);
$session = json_decode(curl_exec($ch), true);
curl_close($ch);
echo $session["data"]["virtual_number"]; // share with both parties
// 2. In your webhook endpoint (a separate script): verify X-Edesy-Signature
$body = file_get_contents("php://input");
$expected = "sha256=" . hash_hmac("sha256", $body, getenv("EDESY_WEBHOOK_SECRET"));
$got = $_SERVER["HTTP_X_EDESY_SIGNATURE"] ?? "";
if (!hash_equals($expected, $got)) {
http_response_code(401);
exit;
}
$event = json_decode($body, true);
error_log($event["event"] . " " . ($event["reference"] ?? ""));
http_response_code(200);JSON in, JSON out. Use cURL or any HTTP client you already have.
Send Authorization: Bearer vp_... on every request. Missing or invalid keys get 401.
Events are signed with HMAC-SHA256 over the raw body, sent as sha256=<hex>. Verify with hash_hmac and hash_equals.
Errors come back as JSON with a code and message, for example insufficient_balance (402) or rate_limited (429).
Rs 1.50/min in 60-second pulses, 1-minute minimum, plus number rental (Rs 499/month mobile, Rs 449/month landline). Prices exclude 18% GST. New accounts get a Rs 20 welcome credit; no card needed to sign up.
Get started on the self-serve portal. Rs 1.50 per minute plus number rental. New accounts get a Rs 20 welcome credit; no card needed to sign up.