How to Test Twilio Webhooks

Twilio sends webhook callbacks for SMS delivery status, incoming messages, voice calls, and other communication events.

Looking for the broader picture? See the 7 best webhook testing tools (2026), or if you're already on Webhook.site, the 60-second migration to HookRay.

1. Twilio Webhook Events

Twilio can send the following webhook events to your endpoint:

2. Set Up a Test Endpoint with HookRay

Follow these steps to start receiving Twilio webhooks for testing:

1. Go to HookRay and click "Start Testing — Free" to get your unique webhook URL.
2. Copy the URL (e.g., https://h.hookray.com/abc123).
3. In your Twilio dashboard, navigate to the webhook settings and paste the HookRay URL as your endpoint.
4. Select the events you want to receive (see list above).
5. Trigger a test event — HookRay will show the incoming webhook in real-time.

3. Sample Twilio Webhook Payload

Here's an example of what a Twilio webhook payload looks like:

{
  "MessageSid": "SM1234567890abcdef",
  "AccountSid": "AC1234567890abcdef",
  "From": "+15551234567",
  "To": "+15559876543",
  "Body": "Hello from Twilio!",
  "MessageStatus": "delivered"
}

4. How to Verify Twilio Webhook Signatures

Node.js (Express)

// Easiest path — let the official SDK assemble the signed string.
import twilio from 'twilio';
import express from 'express';

const app = express();

app.post(
  '/webhooks/twilio',
  express.urlencoded({ extended: false }),
  (req, res) => {
    const signature = req.headers['x-twilio-signature'] as string;
    const fullUrl =
      'https://' + req.headers.host + req.originalUrl; // exact URL Twilio called
    const valid = twilio.validateRequest(
      process.env.TWILIO_AUTH_TOKEN!,
      signature,
      fullUrl,
      req.body, // form-encoded params
    );
    if (!valid) return res.status(401).send('invalid signature');
    res.set('Content-Type', 'text/xml').send(
      '<Response><Message>Got it.</Message></Response>',
    );
  },
);

Python (FastAPI)

# Use the official twilio-python validator — it implements the
# alphabetical-sort + concatenation rules correctly.
import os
from twilio.request_validator import RequestValidator
from fastapi import FastAPI, Request, HTTPException

validator = RequestValidator(os.environ['TWILIO_AUTH_TOKEN'])
app = FastAPI()

@app.post("/webhooks/twilio")
async def twilio_webhook(request: Request):
    form = dict(await request.form())
    signature = request.headers.get('x-twilio-signature', '')
    full_url = str(request.url)  # must be the public-facing URL
    if not validator.validate(full_url, form, signature):
        raise HTTPException(status_code=401, detail='invalid signature')
    return {'ok': True}

Capture a real Twilio webhook with HookRay first, then replay the captured request against your verifier locally — that way you can iterate on the verification code without re-triggering events in Twilio. Read Twilio's official signing docs for the canonical reference, or see the cross-service signature verification guide for Ruby and timing-safe comparison patterns.

5. How Twilio Retries Failed Webhooks

If your handler is going to see the same Twilio event multiple times, you need idempotency by event ID and the right response codes — see the Webhook Retry Strategies guide for the full pattern (idempotency tables, dead-letter queues, replaying captured events for tests). Cross-reference with Twilio's official retry docs before relying on these numbers in production.

6. Frequently Asked Questions

7. Next Steps

• Use HookRay's webhook replay feature to re-send captured webhooks while building your handler
• Enable smart parsing (Pro plan) to see Twilio-specific fields highlighted automatically
• Check the Twilio webhook documentation for the complete event reference