1

I have a redirect widget that calls the AWS Lambda using AWS API Gateway. it returns a twiml-gather then will call an external API base on the output I receive on the twiml-gather

for security reasons, I would like to make my AWS API Gateway have an OAuth or API key

right now, I'm not sure how can i achieve this given that using the redirect widget doesnt have an option to input a http-headers (can't use the Twilio function because of 10 seconds time limit)

clarkoy
  • 410
  • 3
  • 16

1 Answers1

3

You can make use of the X-Twilio-Signature here.

You also find some Twilio blog posts on this topic.

Validating Requests are coming from Twilio https://www.twilio.com/docs/usage/security

If your application exposes sensitive data, or is possibly mutative to your data, then you may want to be sure that the HTTP requests to your web application are indeed coming from Twilio, and not a malicious third party. To allow you this level of security, Twilio cryptographically signs its requests.

Alan
  • 10,465
  • 2
  • 8
  • 9
  • thank you so much, i used the validate request and something confuses me. validateRequest has a URL parameter, what should argument will i put there? is it my AWS API Gateway? – clarkoy Jul 28 '22 at 19:22
  • 1
    Your webhook endpoint per this blog post - https://www.twilio.com/blog/how-to-secure-twilio-webhook-urls-in-nodejs – Alan Jul 28 '22 at 20:30