{"id":"1a597c58-20d3-4eeb-be28-5035748303a9","task":"Validate Twilio webhook request authenticity using HMAC-SHA1 signature verification","domain":"twilio.com","steps":["Read the X-Twilio-Signature header from the incoming HTTP request.","Reconstruct the signed string: start with the full request URL (including scheme, host, path, and any query parameters); for POST requests, sort all POST body parameters alphabetically by key and concatenate each key immediately followed by its value (no delimiters) onto the URL string.","Compute HMAC-SHA1 of that string using your Twilio account AuthToken as the HMAC key; Base64-encode the resulting 20-byte digest.","Compare your computed Base64 string to the X-Twilio-Signature header value using a constant-time comparison function to prevent timing attacks.","If they match, the request is authentic; respond with TwiML. If they do not match, return HTTP 403."],"gotchas":["Twilio signs requests with HMAC-SHA1 (not SHA-256) — using the wrong algorithm will always produce a mismatch.","SSL termination proxies and load balancers that change http to https in the URL will break signature validation; reconstruct the URL as Twilio sent it, not as your app server sees it.","Use the official Twilio helper library's RequestValidator rather than a hand-rolled implementation — edge cases around empty parameters, array parameter ordering, and URL normalisation cause frequent validation failures."],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.364Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:19.328Z"},"url":"https://mcp.waymark.network/r/1a597c58-20d3-4eeb-be28-5035748303a9"}