Twilio webhooks
Test and debug Twilio webhooksfor SMS, voice and video
Capture every status callback and incoming-call request Twilio sends. Read the parameters, check the signature header against your own code and test call flows without dialing a number.
How Twilio webhooks work
| Signature header | X-Twilio-Signature: HMAC-SHA1 over your webhook URL and all request parameters, keyed with your account auth token. |
|---|---|
| Default timeouts | Connect timeout 5000 ms, read timeout 15000 ms, total time 15000 ms. Voice call requests have a hard 15-second limit. |
| Default retry | 1 retry, on connection failures only (rc=1, rp=ct). Override per URL with a fragment such as #rc=2&rp=4xx,5xx,ct,rt. |
| Fragments and signatures | Twilio leaves the #fragment out of the signature computation, so drop it when you validate. |
| Retry header | I-Twilio-Idempotency-Token distinguishes retry attempts. |
Sources (checked November 2026)
See each request in Twilio's event pipeline
Twilio webhooks power SMS verification, call handling and appointment reminders. When status callbacks fail, customers get frustrated and support tickets pile up.
Hooklistener keeps a history of every Twilio request your endpoint receives. Inspect delivery receipts, error codes and signature headers without digging through logs or waiting for a customer complaint.
Common Twilio webhook challenges
Delivery status mysteries
An SMS shows as sent but the customer says it never arrived. You need every status callback for that message, with its error code, in one place.
Signature validation failures
A wrong auth token breaks X-Twilio-Signature checks in production, and the error rarely says why.
Call flow debugging
IVR trees fail quietly. You need to trace call events, recording callbacks and conference webhooks through every branch.
How Hooklistener helps with Twilio webhooks
Inspect Twilio status callbacks
Read every Twilio status callback for a message, from queued to delivered or failed, with its form parameters and error code, so a "never received" SMS has a clear trail.
Raw headers for your signature check
See the exact URL, parameters and X-Twilio-Signature header Twilio sent, so you can find out why your own validation code rejects a request that looks right.
Custom TwiML responses
Have the endpoint return the TwiML, status and latency you choose to walk a Twilio IVR branch without writing the handler first, then move to localhost with `hooklistener tunnel`.
Try it: point Twilio at a free webhook URL or run a test with the webhook tester.
Twilio workflows that benefit most
2FA and verification
Follow OTP delivery through every SMS status callback and see where carrier filtering or failures happen.
Appointment reminders
Check reminder delivery across many recipients and find failures before appointments are missed.
Call center automation
Follow IVR interactions, queue callbacks and agent connections with the full request history.
Replay a failed webhook without re-triggering the provider
Once a delivery is captured, you can resend its exact headers and body to localhost, staging or production from the dashboard or through your coding agent over MCP, so the provider never has to fire a new event. Replay is on Pro and above. Read the replay guide.
Comparing webhook debugging tools?
See how Hooklistener stacks up against webhook.site, RequestBin, Beeceptor, Hookdeck and ngrok in the best tools to capture and inspect webhook payloads, or read the head-to-head pages for Hooklistener vs ngrok and Hooklistener vs Beeceptor.
Frequently asked questions
Does Hooklistener validate Twilio signatures?
No. Built-in signature verification covers Stripe, GitHub and Slack. For Twilio, Hooklistener shows the full URL, parameters and X-Twilio-Signature header so you can check your own validation code against the exact request.
Can I replay failed SMS callbacks?
Yes. Replay is on Pro and above. Resend a captured status callback to localhost or staging to test retry logic and error handling.
How do I test Twilio webhooks on localhost?
Run hooklistener tunnel --port 3000 and use the HTTPS URL as your Twilio webhook. You get a random hook.events subdomain on Free, and a static subdomain that survives restarts on Pro.
Can support teams look at webhook data?
Yes. Search the history by message SID or phone number, or send a shareable debugger link to the request in question.
Never lose another Twilio event
See every SMS status callback and call request your endpoint receives, and debug faster.