### Security

To safeguard a webhook endpoint, verify that incoming requests are genuinely sent by the Voice API and have not been altered in transit. This prevents unauthorized access and mitigates risks such as man-in-the-middle attacks.

1. Each service has an identifier and a secret.
2. When a webhook arrives, use the secret to compute a signature over the canonical request string.
3. Compare the computed signature to the one in the request authorization header.
4. Only process the webhook if the signatures match.


For the exact `Authorization` header format, the canonical string that is signed, the signature algorithm and a worked example, see *Request signing* on the **Call webhook** operation in the **Webhooks** section.

Access to the webhook endpoint may also be restricted by IP address, and HTTPS can be used to encrypt traffic.