Business phones, on your own server.

POST /hooks/asterfi
X-AsterFi-Event: call.answered
X-AsterFi-Signature: t=1761676543,v1=5f2a…c9

{
  "id": "4812",
  "event": "call.answered",
  "timestamp": "2026-10-28T18:35:43.477Z",
  "data": {
    "id": "1761676521.42",
    "direction": "inbound",
    "from": "8605550142",
    "to": "8605550100",
    "answeredBy": "104",
    "state": "talking"
  }
}

import crypto from 'node:crypto';

function verifyAsterFi(rawBody, header, secret) {
  const p = Object.fromEntries(
    header.split(',').map((x) => x.split('=')));
  const t = Number(p.t);
  // reject anything older than 5 minutes
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const want = crypto.createHmac('sha256', secret)
    .update(`${t}.${rawBody}`).digest('hex');
  const a = Buffer.from(want), b = Buffer.from(p.v1 || '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

function verify_asterfi(string $raw, string $header, string $secret): bool {
  parse_str(str_replace(',', '&', $header), $p);
  $t = (int)($p['t'] ?? 0);
  if (!$t || abs(time() - $t) > 300) return false;
  return hash_equals(
    hash_hmac('sha256', "$t.$raw", $secret),
    $p['v1'] ?? ''
  );
}

# Every call with one customer, newest first
curl -H "Authorization: Bearer $ASTERFI_KEY" \
  "https://pbx.yourcompany.com/api/v1/calls?number=8605550142"

# Who's on the phone right now
curl -H "Authorization: Bearer $ASTERFI_KEY" \
  "https://pbx.yourcompany.com/api/v1/calls/active"