HMAC-SHA1 verification over the full public request URL plus every POST parameter sorted by key, compared in constant time. The URL is reconstructed from the proxy's forwarded headers, not from the raw request URL. If the parent token fails and the payload names a different account, the owning account is looked up and its token is tried.
Also called: 11200 error · webhook signature · inbound text rejected · 403 from carrier
- 1The receiver rebuilds the URL from x-forwarded-proto and x-forwarded-host.
- 2It verifies against the platform token first.
- 3On failure, the AccountSid on the payload is used to find the owning account's binding.
- 4That account's decrypted token is used for a second verification.
- 5An unknown account, or one with no stored credentials, is refused with a 403.
Recorded on the SMS receiver (Keith 08-14): 'This verified against the PLATFORM token only. Tenant numbers live on their own subaccounts, and Twilio signs with the token of the account the message was delivered to — so every inbound text to a subaccount number was rejected, Twilio logged 11200, and the message never reached the thread. Silently: the sender saw it send fine.' The proxy caveat is called out as 'the classic reason a correct implementation still rejects every request'.
- Every inbound message to an isolated account's number was rejected.
- Reconstructing the URL from the internal origin broke verification behind a proxy.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →