Webhooks

Overview

Intry Core acts as the consumer of third-party webhooks rather than exposing public “customer webhooks” for arbitrary partners (that pattern may arrive later). Today the critical inbound streams are Twilio and Stripe.

Twilio

Requirements

• Validate X-Twilio-Signature using your Twilio auth token.
• Use environment-specific public URLs (ngrok / staging host / production domain).
• Log Twilio Call SIDs alongside internal Call.id for support.

Stripe

Requirements

• Verify signing secret from Stripe dashboard.
• Keep idempotent handlers — Stripe retries aggressively.

Building outbound webhooks (future)

If you add partner callbacks:

• Sign payloads with HMAC secrets.
• Document retry/backoff and dead-letter behavior.
• Version event types (intry.call.completed.v1, etc.).