Mountable signed Telnyx v2 webhook admission. This module starts no listener.
Mount webhook/2 before a JSON body parser. Supply :public_key and a bounded
:on_event admission callback. The callback must atomically authorize and
deduplicate the verified event and enqueue admitted work. It returns one of
these values; return :ok for an already admitted duplicate too:
| Callback return | HTTP status | Response body |
|---|---|---|
:ok | 200 | "OK" |
{:error, :backpressure} | 503 | "Unavailable" |
{:error, reason} for any other reason | 403 | "Forbidden" |
The 503 response allows Telnyx to retry delivery. Do not perform REST commands in the admission callback; run them in supervised workers.
Signature freshness does not replace event/call deduplication. The host retains terminal call identities and enforces listener, mailbox and concurrency bounds. Neither caller ID nor possession of an event ID authenticates an application user.
Summary
Functions
Admit a media upgrade using Telnyx's separate authentication header.
Verify the exact bounded request body before decoding or invoking application code.
Functions
Admit a media upgrade using Telnyx's separate authentication header.
The host's :authorize callback receives (conn, token) and must atomically
compare/consume an expiring, call-bound token before returning
{:ok, socket_options}. Use constant-time comparison. The API key is never a
stream credential. Never accept an unverified token echoed in a connected frame.
Verify the exact bounded request body before decoding or invoking application code.