### Security

To safeguard a webhook endpoint, verify that incoming requests are genuinely sent by the Voice API and have not been altered in transit. This prevents unauthorized access and mitigates risks such as man-in-the-middle attacks.

1. Each service has an access key and secret.
2. When a webhook arrives, use the key and secret to compute a hash of the payload.
3. Compare the computed hash to the signature in the request authorization header.
4. Only process the webhook if the hashes match.


Access to the webhook endpoint may also be restricted by IP address, and HTTPS can be used to encrypt traffic.