Webhook security

Verification

Inbound provider callbacks are checked before they touch any data:

• Twilio - the request signature is verified against your account auth token and the full externally visible URL (forwarded protocol and host are taken into account).
• Africa's Talking and Yeastar - verified with the configured shared secret or verify token.
• Bad or missing credentials get 403; unknown workspaces get 404.

Idempotency

Every callback is deduplicated by provider event ID in webhook_events. A replayed delivery is acknowledged but not processed twice. Your own outbound webhook consumer should do the same - dedupe on the event id.

Retries

Outbound deliveries go through the durable job queue. If your endpoint errors or times out, the delivery is retried rather than dropped.