HookGet Open dashboard

Twilio → HookGet

Twilio calls HookGet; the request is verified at the door and becomes normalised events on the same pipeline as everything else you deliver.

In short

  • Point a Twilio status callback at the ingest URL and paste your auth token — verification runs Twilio's exact recipe (URL + sorted params, HMAC-SHA1).
  • The verification URL comes from HookGet's own configuration, never from request headers — a caller cannot bend the signature base.
  • Calls become call.received / call.answered / call.completed / call.missed with duration; SMS becomes sms.received / sms.delivered.
  • Phone numbers are PII: the call SID is the entity, the numbers stay in the raw payload and are declared as PII fields.

What it produces

Twilio sendsBecomesData
CallStatus: ringing / initiated (inbound)call.receiveddirection, from_country
CallStatus: in-progresscall.answered—
CallStatus: completedcall.completedduration_s
CallStatus: no-answer / busycall.missedduration_s
CallStatus: failed / canceledcall.failed—
MessageStatus: received / deliveredsms.received / sms.delivered—

Set up

curl -X POST https://api.hookget.com/v1/sources \
  -H "authorization: Bearer $HOOKGET_KEY" \
  -d '{"provider":"twilio","secret":"<your Twilio auth token>"}'
# -> in Twilio: set the number's status callback (voice and/or SMS)
#    to the returned ingest URL, method POST
How an inbound webhook is verified before it enters A provider sends a signed request. HookGet verifies the signature or token and deduplicates on the provider's delivery id before the event exists. A request that fails verification is refused with a 401 and never enters the pipeline. A verified event flows into the same pipeline as any other: retries, timeline, replay. The provider GitHub, Stripe, 13 more Verified at the door signature or token · dedupe The same pipeline retries · timeline · replay Refused bad signature → 401, nothing enters
Verification happens before the event exists, so a forged request is refused at the door — it is never stored, never retried, never seen again. Redeliveries are deduplicated on the provider’s own delivery id.

Stated plainly

Twilio posts form-encoded bodies and signs the URL together with the parameters — both handled natively. What this source does NOT do: place calls, fetch recordings, or read message history. It receives what Twilio reports, verifies it, and hands it to the same pipeline as everything else — the missed-call alert is then a filter on call.missed, not a Twilio feature.

Questions

Which credential do I paste?

Your Twilio auth token (or an API-key secret configured as the signing key for the callbacks). It is stored encrypted, used only to verify signatures, and returned by no route.

Why do calls matter in a marketing dashboard?

Because for high-intent offers the phone is where the conversion happens, and it is the one channel web analytics cannot see. With calls as events, "leads that called" joins the same funnel as leads that clicked — and a missed-call spike during ad hours becomes an anomaly alert instead of a mystery in next month's numbers.