---
title: "Verify Twilio Webhook Signatures — Free Online Tool | WebhookRelay"
meta:
"og:description": "Free online Twilio webhook signature verifier. Validate the X-Twilio-Signature header for form-encoded webhook callbacks. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
"og:title": "Verify Twilio Webhook Signatures — Free Online Tool"
description: "Free online Twilio webhook signature verifier. Validate the X-Twilio-Signature header for form-encoded webhook callbacks. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
---
# **Verify Twilio Webhook Signatures**
Twilio signs requests differently from most providers: it takes your exact webhook URL, appends every POST parameter sorted alphabetically (key immediately followed by value), and computes HMAC-SHA1 with your Auth Token, base64-encoded. The result is sent in `X-Twilio-Signature`. Enter the URL, the POST parameters and your Auth Token.
**Request URL**
**POST parameters (one **`key=value`** per line)**
**Auth token**
**Computed signature**
**Signature to verify **(X-Twilio-Signature)
**Paste the X-Twilio-Signature value above to compare**
Everything runs in your browser — the payload and secret never leave this page. Want to verify a different provider? See the [webhook signature verifier hub](https://webhookrelay.com/verify-twilio-webhook-signature/verify-webhook-signature/) or the generic [HMAC generator](https://webhookrelay.com/verify-twilio-webhook-signature/hmac-verification/).
## **How Twilio signs webhooks**
1. Start with the full request URL exactly as configured (including https:// and any query string).
2. Sort the POST parameters alphabetically by name and append each name immediately followed by its value.
3. Compute HMAC-SHA1 of that string using your Auth Token as the key, base64-encoded.
4. Compare to `X-Twilio-Signature` with a constant-time check.
**References & official docs:**
- [Twilio — Security: validating signatures](https://www.twilio.com/docs/usage/security)
- [Twilio — Webhooks security](https://www.twilio.com/docs/usage/webhooks/webhooks-security)
## **Verify Twilio signatures in code**
**Node.js**
```
const twilio = require('twilio');
const valid = twilio.validateRequest(
process.env.TWILIO_AUTH_TOKEN,
req.headers['x-twilio-signature'],
url, // the exact URL Twilio requested
req.body); // parsed POST params
```
**Python**
```
from twilio.request_validator import RequestValidator
validator = RequestValidator(auth_token)
valid = validator.validate(
url, # the exact URL Twilio requested
request.form, # POST params
request.headers['X-Twilio-Signature'])
```
## **Frequently asked questions**
**Why is Twilio different from Stripe or GitHub?**
Twilio signs the URL plus the sorted POST parameters (not the raw JSON body) with HMAC-SHA1. This tool covers that standard form-encoded callback scheme; JSON bodies and the newer public-key signatures work differently.
**What key does Twilio use?**
Your account Auth Token, found in the Twilio Console. Rotate it carefully — it signs every request from Twilio.
## **Verify other providers**
[Stripe](https://webhookrelay.com/verify-twilio-webhook-signature/verify-stripe-webhook-signature/) [ GitHub](https://webhookrelay.com/verify-twilio-webhook-signature/verify-github-webhook-signature/) [ Shopify](https://webhookrelay.com/verify-twilio-webhook-signature/verify-shopify-webhook-signature/) [ Slack](https://webhookrelay.com/verify-twilio-webhook-signature/verify-slack-webhook-signature/) [**S** Standard Webhooks](https://webhookrelay.com/verify-twilio-webhook-signature/verify-standard-webhooks-signature/) [ Square](https://webhookrelay.com/verify-twilio-webhook-signature/verify-square-webhook-signature/) [**L** LINE](https://webhookrelay.com/verify-twilio-webhook-signature/verify-line-webhook-signature/) [**A** Airwallex](https://webhookrelay.com/verify-twilio-webhook-signature/verify-airwallex-webhook-signature/) [**M** MyFatoorah](https://webhookrelay.com/verify-twilio-webhook-signature/verify-myfatoorah-webhook-signature/) [ Zendesk](https://webhookrelay.com/verify-twilio-webhook-signature/verify-zendesk-webhook-signature/) [ DocuSign](https://webhookrelay.com/verify-twilio-webhook-signature/verify-docusign-webhook-signature/) [**K** Klarna](https://webhookrelay.com/verify-twilio-webhook-signature/verify-klarna-webhook-signature/) [**A** Attio](https://webhookrelay.com/verify-twilio-webhook-signature/verify-attio-webhook-signature/)
[HMAC Generator](https://webhookrelay.com/verify-twilio-webhook-signature/hmac-verification/) [CloudEvents Validator](https://webhookrelay.com/verify-twilio-webhook-signature/cloudevents-validator/) [Webhook Tester (Bin)](https://webhookrelay.com/verify-twilio-webhook-signature/webhook-bin/)
Receiving Twilio webhooks on a server behind a firewall or on localhost? Webhook Relay can [forward them to your internal service](https://webhookrelay.com/verify-twilio-webhook-signature/webhooks/) and even [verify or transform them](https://webhookrelay.com/verify-twilio-webhook-signature/features/transform-webhooks/) before delivery.