A URL builder that walks candidate environment values, rejects anything that is not https, rejects localhost and .local hosts, falls back to the production origin, and finally rewrites an apex host to www. The same rule is applied to the SMS receiver, the voice receiver, and the TwiML app used for browser calling.
Also called: 403 on webhook · signature mismatch · www vs apex · calls fail for no reason
- 1Candidates are read in order and each is validated as public https.
- 2Anything local or non-https is skipped.
- 3If none qualifies, the canonical production origin is used.
- 4An apex host is rewritten to www as the last step.
Two separate incidents are recorded. The redirect one (Keith 08-14): 'the apex 308s to www. Twilio follows the redirect, but it SIGNED the apex URL — and the handler validates against the URL the request actually arrived at (www). The signatures can't match, the webhook 403s, and the caller hears the line fail. An inbound call to Graber's number died exactly this way while every Twilio-side setting looked correct.' The localhost one: returning null on a dev host 'meant a builder clicking "Take this one" from a dev session got the number PURCHASED and then an error — a real, billing line with no webhooks on it... Webhook URLs are a property of the DEPLOYMENT, not of whoever happens to be running the app.'
- A redirecting apex URL broke signature validation on every inbound webhook.
- A developer session could register a localhost URL, leaving a live number dead.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →