Delivery behaviour
Read from the vendor's own documentation, last checked 2026-08-06. Where the vendor states no number, this table carries none.
| Response budget | 15s Configurable. rt read timeout default 15000ms (max 15000), ct connect default 5000ms (max 10000), tt total default 15000ms |
|---|---|
| Retry | Configurable: rc 0 to 5, default 1. rp selects which failures qualify |
| Gives up | not published by the vendor |
| Source | https://www.twilio.com/docs/usage/webhooks/webhooks-connection-overrides |
Signature
Verified against a working verifier proven by a test suite, not read from documentation. Last verified 2026-08-20.
| Algorithm | HMAC-SHA1 |
|---|---|
| Signed payload | full URL + form params sorted by key |
| Encoding | base64 |
| Header | x-twilio-signature |
| Tolerance | none enforced |
Verify it
The raw request body, byte for byte, before any JSON parsing. Every scheme on this page breaks the moment a framework re-serializes the payload.
const crypto = require("node:crypto");
// base64(HMAC-SHA1(auth token, url + form params sorted by key, concatenated))
const sorted = Object.keys(req.body).sort();
const base = fullUrl + sorted.map((k) => k + req.body[k]).join("");
const expected = crypto
.createHmac("sha1", authToken)
.update(base)
.digest("base64");
const valid = crypto.timingSafeEqual(
Buffer.from(req.headers["x-twilio-signature"]),
Buffer.from(expected),
);The signature covers the full public URL, query string included. TLS termination or a path-rewriting proxy in front of the handler changes the URL Twilio signed, and the mismatch looks exactly like a forged request.
What bites
Five delivery parameters are configurable per URL — connect timeout, read timeout, total time, retry count, retry policy — and the defaults (15s total, 1 retry) are what almost everyone runs. The dial exists; nobody turns it.
Read more
AnyHook sits in front of endpoints that receive from Twilio: it answers inside the budget above, retries on its own schedule when your server is down, and keeps every event replayable. Change one URL, keep your code.