Twilio Webhook Signature Verification in n8n (403 Reject)

Verify Twilio webhook authenticity in n8n—block forged requests with a 403

This n8n workflow receives inbound Twilio webhooks, verifies the X-Twilio-Signature using your Twilio Auth Token and the exact webhook URL, and instantly rejects invalid requests with a 403 TwiML. Legitimate requests continue to your custom logic safely.

What this workflow does

• Receives a POST request from Twilio on an n8n Webhook endpoint.
• Loads verification inputs: your Twilio Auth Token and the public webhook URL (including any query string) used for signature verification.
• Recomputes the expected signature by hashing the webhook URL plus sorted POST parameters using HMAC-SHA1, then compares it to the incoming X-Twilio-Signature header.
• Valid signature path: if the signature matches, the request continues to your custom processing and returns an empty TwiML response.
• Invalid/missing signature path: if the signature is invalid or absent, the workflow immediately returns 403 with an empty TwiML response to Twilio.

Use cases

• Protect Twilio Voice or Messaging webhook endpoints from spoofed traffic.
• Harden an n8n-hosted SaaS backend that handles inbound SMS/voice events.
• Ensure only requests signed by Twilio can trigger downstream automations.

Technical details

• Nodes/logic used: webhook, if, set, code (HMAC calculation), no op, and sticky note.
• Set your Twilio Auth Token as TWILIO_AUTH_TOKEN (recommended) or update the placeholder in the Config step.
• Set TWILIO_WEBHOOK_URL to the exact public HTTPS URL Twilio calls (including query string).
• For self-hosted n8n, ensure the Code node can access Node’s crypto module (e.g., NODE_FUNCTION_ALLOW_BUILTIN=crypto) so HMAC-SHA1 can be computed.

Result: stronger Twilio webhook security in n8n—signature verification, safe handling, and 403 rejection for forged requests.