Telnyx Webhooks Skill

When to Use This Skill

• How do I receive Telnyx webhooks?
• How do I verify Telnyx webhook signatures?
• How do I verify the telnyx-signature-ed25519 / telnyx-timestamp headers?
• How do I handle message.received, message.sent, or message.finalized events?
• Why is my Telnyx webhook signature verification failing?

Verification (core)

Telnyx Webhook API v2 signs every event with an Ed25519 public-key signature (not HMAC, not the Standard Webhooks spec). Two headers are sent:

• telnyx-signature-ed25519 — base64-encoded Ed25519 signature (64 bytes)
• telnyx-timestamp — Unix seconds when the event was signed

The signed message is `${telnyx-timestamp}|${raw_body}` (timestamp, a literal |, then the raw request body — never re-serialized JSON). Verify it with your account's base64 public key from Mission Control → Account Settings → Keys & Credentials → Public Key (per-account, not per-profile). Enforce a timestamp tolerance (5 minutes) to block replays.

SDK note: The telnyx@7 (Node) and telnyx (Python) SDKs expose client.webhooks.unwrap(), but the pinned versions wire it to the Standard Webhooks library, which expects webhook-id / webhook-signature / webhook-timestamp headers — not Telnyx's Ed25519 scheme — so it rejects genuine Telnyx webhooks. Verify manually with a maintained Ed25519 library instead (below). See references/verification.md.

Node (tweetnacl):

const nacl = require('tweetnacl');

function verifyTelnyx(rawBody, signature, timestamp, publicKeyB64) {
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp, 10)) > 300) return false; // replay guard
  const message = Buffer.from(`${timestamp}|${rawBody}`, 'utf8');   // raw body!
  try {
    return nacl.sign.detached.verify(
      new Uint8Array(message),
      new Uint8Array(Buffer.from(signature, 'base64')),
      new Uint8Array(Buffer.from(publicKeyB64, 'base64'))
    );
  } catch { return false; }
}

Python (PyNaCl):

import base64, time
from nacl.signing import VerifyKey
from nacl.exceptions import BadSignatureError

def verify_telnyx(raw_body: bytes, signature: str, timestamp: str, public_key_b64: str) -> bool:
    if abs(int(time.time()) - int(timestamp)) > 300:  # replay guard
        return False
    signed = f"{timestamp}|".encode() + raw_body       # raw body!
    try:
        VerifyKey(base64.b64decode(public_key_b64)).verify(signed, base64.b64decode(signature))
        return True
    except (BadSignatureError, ValueError):
        return False

For complete handlers with route wiring, event dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

Common Event Types

Every webhook is wrapped in a data envelope: { "data": { "event_type": "...", "id": "...", "occurred_at": "...", "payload": { ... }, "record_type": "event" }, "meta": { "attempt": 1, "delivered_to": "..." } }.

For the full event reference, see Telnyx webhook docs.

Environment Variables

# Account public key (base64) from Mission Control → Account Settings → Keys & Credentials → Public Key
TELNYX_PUBLIC_KEY=eu2zvPjhY6odxV34Z/EsRiERvTodkev4Fq0SlK90Izg=

Delivery & Retries

• Return a 2xx within 2000ms or Telnyx treats the delivery as failed.
• On failure Telnyx retries with exponential backoff (up to ~6 attempts) and then fails over to the configured failover URL.
• Configure the webhook URL, failover URL, and Webhook API version (v1 legacy/unsigned vs v2 signed) per messaging profile or per connection/app in Mission Control.

Local Development

# Start a tunnel (no account needed)
npx hookdeck-cli listen 3000 telnyx --path /webhooks/telnyx

Reference Materials

• references/overview.md - Telnyx webhook concepts, common events, payload structure
• references/setup.md - Mission Control configuration, getting the public key
• references/verification.md - Ed25519 signature verification details and gotchas