Channel integration callbacks
How WhatsApp, voice and other providers call into KitoDesk.
Overview
Providers call into KitoDesk on registered callback routes. You normally do not call these yourself - you register them with the provider during channel setup. They are listed here so you can understand the flow and verify registrations.
Verification per provider
| Provider | How callbacks authenticate |
|---|---|
| Twilio | Request signature verified with your auth token against the full public URL |
| Africa's Talking | Shared secret / verify token |
| Yeastar | Shared secret (sign route excluded from the voice exemption) |
| Verify token at handshake, then signed payloads |
Behaviour
- Callbacks are exempt from the browser-origin check but always signature/secret-verified.
- Deliveries are idempotent: a duplicate provider event is acknowledged, not reprocessed.
- Callbacks resolve the workspace from the slug or token in the path - no tenant ID in the body.
- Recording callbacks carry the recording URL; KitoDesk stores a reference, not the audio.
Was this guide helpful?