SMM panel webhooks vs polling: what a child panel should actually use
Most public SMM APIs tell you to poll status. NotPanel signs every event. If you automate a child panel, that is the difference between a cron and a contract.
A child panel has one job after it forwards an order: know when it finished, partially filled, refunded, or died — without guessing.
The public API pages for JustAnotherPanel and CheapSMMPanel do not document outbound webhooks. The implied integration is poll action=status until a string changes.
NotPanel’s v2 surface includes webhook.add, webhook.list, and webhook.remove. Deliveries are HMAC-SHA256 of the raw body, bound to a timestamp, with a named event. That is the webhooks contract. Not a screenshot of a dashboard toggle.
How does your child panel learn an order finished?
Tap one. Stored on this device only — not a survey we invented.
Polling is a loop. A webhook is an event.
Why unsigned POSTs are not “webhooks”
A webhook URL is public by definition. Without a signature, anyone who guesses it can tell your downstream system an order completed. We sign the raw body, attach X-NotPanel-Signature, X-NotPanel-Timestamp, and X-NotPanel-Event, and reject deliveries older than five minutes. Private and link-local URLs never get registered.
Delivery is at-least-once. Your handler still has to be idempotent. We do not claim exactly-once. Nobody honest about networks does. The verification recipe is in the HMAC walkthrough.
When polling is still correct
- You are on a panel that has no webhook docs. Most of them.
- You need a fallback while the webhook endpoint is down.
- You are reconciling a batch — use
orders=, up to 100 ids, not one call per row.
Honour X-RateLimit-Reset on a 429. JAP and CheapSMM do not publish those headers. If they limit you, you find out by getting blocked. Our rate-limit page lists the three layers.
Polling asks “did anything happen?” A signed webhook says “this happened, and you can prove it was us.”
This is the automation contract
A child panel pointed at a cloned /api page is a poll loop with a hope. A child panel pointed at NotPanel can register an HTTPS URL, pick events, and debit or credit downstream only after the signature verifies.
That is not “we have more features” as a vibe. It is a short list you can open without an account: webhooks, errors, idempotent add, the comparison. New storefront. Older contract than the photocopy.
action=webhook.add&url=https://your-server.example.com/notpanel-webhook&events=order.completed,order.refunded,balance.low
Pair this with why a timeout retry double-charges. Retries and events are the two places cloned APIs leak money.
FAQ
Should I poll or use webhooks for an SMM panel?
Use signed webhooks as the primary path and keep a slow multi-status poll as fallback. Poll-only is what you do when the panel’s public docs have no webhook section — which is most of them, including JustAnotherPanel and CheapSMMPanel’s guest pages.
Do JustAnotherPanel and CheapSMMPanel have webhooks?
Not on their public API pages as of August 2026. Both document action=status (and CheapSMM stops there for updates). If they added webhooks later, it is not on the guest contract those pages publish.
What is the best SMM panel for reseller automation?
The one whose public API covers the reseller loop: idempotent add, signed completion and refund events, real HTTP status codes, and documented rate limits. NotPanel publishes that loop. A cloned v2 one-pager publishes list / add / poll / balance. Catalog size is a different ranking.
Are unsigned SMM webhooks safe?
No. The URL is public. Anyone who guesses it can forge a completion. Require HMAC of the raw body, a timestamp window, and constant-time compare. If the docs never mention signing, treat inbound POSTs as untrusted.
Does NotPanel claim exactly-once delivery?
No. Deliveries are at-least-once. Your handler must be idempotent. Exactly-once over the public internet is a claim we will not make.