Test a Twilio webhook locally
Validating a Twilio handler (incoming SMS or call) without sending real paid messages is possible. Generate a Twilio request signed (X-Twilio-Signature, HMAC-SHA1) in form-urlencoded format, edit the parameters (From, To, Body) and send it to your local server.
Verify the signature server-side
const twilio = require('twilio');
const valid = twilio.validateRequest(
process.env.TWILIO_AUTH_TOKEN,
req.headers['x-twilio-signature'],
fullUrl, // must match the target URL used above
req.body // POST parameters
);To receive a real Twilio webhook on your machine, point the number to your Relay tunnel.
Signature coming back invalid? This page signs. The Twilio signature validator does the opposite: paste the signature Twilio actually sent and it tells you which URL variant matches — which is to say, which line of your code is lying.
Frequently asked questions
How do I test an incoming Twilio SMS locally?
Pick the 'Incoming SMS' event, enter your Auth Token and the exact URL of your handler (the Twilio signature depends on the URL), then send. The X-Twilio-Signature header is computed with HMAC-SHA1 over the URL + sorted parameters, just like Twilio does.
Why do I have to provide the target URL?
The Twilio signature includes the full webhook URL in the HMAC computation. Without the right URL, the signature won't be valid server-side. That's why the target URL field is required for Twilio.
Is the format really form-urlencoded?
Yes. Unlike Stripe or GitHub (JSON), Twilio sends application/x-www-form-urlencoded. The generator produces the right Content-Type and encodes the parameters correctly.
Is Twilio included in the free plan?
No: every Signer provider, Twilio included, is free. The 7-day Pass (€5) and Pro (€9/month) add AI explanations, 25 permanent URLs, 30-day history and the Relay tunnel, which returns your local TwiML to Twilio.