aircall-webhooks

Aircall Webhooks

Aircall is a cloud call-center / business phone system. Its webhooks push call, user, number, contact, messaging, and conversation-intelligence events to your endpoint.

When to Use This Skill

• How do I receive Aircall webhooks?
• How do I verify Aircall webhooks? (there is no signature header — see below)
• Why is my Aircall webhook verification failing?
• How do I handle call.created, call.answered, or call.ended events?
• How do I get my Aircall webhook token?
• Why did Aircall disable my webhook?

Verification: Token in the Body, NOT an HMAC Signature

Aircall has no signature header and no cryptographic signature. Every event body contains a top-level token string equal to the token issued when the webhook was created. Verify by comparing that field against your stored token.

Do not look for X-Aircall-Signature, HMAC-SHA256, or Standard Webhooks headers — none exist. Third-party blog posts that describe an Aircall HMAC header are wrong. (Aircall's own docs loosely say "verify webhook signatures" in a code comment, but the mechanism is a plain shared-secret comparison.)

Verification (core)

const crypto = require('crypto');

// Aircall sends its shared secret verbatim as `token` in the JSON body.
// Compare in constant time so the token can't be recovered by timing.
function verifyAircallWebhook(payloadToken, expectedToken) {
  if (typeof payloadToken !== 'string' || !expectedToken) return false;
  try {
    return crypto.timingSafeEqual(
      Buffer.from(payloadToken),
      Buffer.from(expectedToken)
    );
  } catch {
    return false; // different lengths -> invalid
  }
}

// Usage: const { resource, event, timestamp, token, data } = req.body;
// if (!verifyAircallWebhook(token, process.env.AIRCALL_WEBHOOK_TOKEN)) -> 401

import secrets

def verify_aircall_webhook(payload_token: str | None, expected_token: str | None) -> bool:
    if not payload_token or not expected_token:
        return False
    return secrets.compare_digest(payload_token, expected_token)