How can a Proxy callback be verified?

Use a Twilio SDK to validate `X-Twilio-Signature` with the account Auth Token, exact public callback URL, and complete form parameter set.

What is the difference between CallbackUrl and InterceptCallbackUrl?

`CallbackUrl` is an informational notice for a new interaction. `InterceptCallbackUrl` can stop that interaction, but only a 403 response blocks it.

What can an out-of-session callback return?

It can return valid TwiML for Twilio to process or JSON directing Proxy to create a Session with another participant.

Can a robots.txt rule block TwilioProxy/1.1?

No. The client is calling a URL saved on the Proxy Service, not crawling discoverable pages. Remove the callback configuration or enforce endpoint authentication instead.

Does Twilio Proxy affect AI search or training?

No documented part of this workflow feeds AI search or model training. It routes communications and reports interactions to the configured application.

Twilio Proxy: What It Is & How to Handle It

What is Twilio Proxy?

Twilio Proxy masks direct contact details during calls and messages. An application creates a Proxy Service, opens a Session, and adds Participants with their real identifiers. Proxy assigns or uses proxy identifiers from the service's number pool, then maps traffic through the open Session so each participant sees the proxy number rather than the other person's number.

A Service can send three kinds of callback. CallbackUrl receives an informational webhook for each new interaction. InterceptCallbackUrl runs for an interaction before it proceeds; a 403 response blocks it, while any other status or a timeout lets it continue. OutOfSessionCallbackUrl handles an inbound call or SMS for which no open Session exists. That endpoint can return TwiML or auto-create Session JSON for Proxy to act on.

Proxy submits webhook fields as application/x-www-form-urlencoded. Twilio's webhook security documentation says its HTTP requests include X-Twilio-Signature, calculated from the account Auth Token, exact webhook URL, and request parameters with HMAC-SHA1. Twilio recommends its server SDK validator because parameter sets can change. The recorded client identity is TwilioProxy/1.1, but that user agent is not an authentication credential.

The request belongs to a phone or messaging workflow initiated through Twilio Proxy. It does not crawl web pages, supply documents to AI search, or collect training data. robots.txt cannot govern a service callback or the routing decision that follows its response.

Not relevant for AI search

Is Twilio Proxy relevant for AI search?

No. Twilio Proxy is not part of AI search or training, so allowing or blocking it does not change your AI visibility.

Twilio Proxy is not a crawler. It delivers webhook notifications to endpoints you registered, so it never fetches public content for an AI product. Robots.txt does not apply, and allowing or blocking it has no effect on AI search or training.

How to handle Twilio Proxy

Put Proxy callbacks on HTTPS routes and validate every X-Twilio-Signature with a Twilio server SDK and the account Auth Token. The validator needs the exact public URL and every form parameter. If a load balancer changes the scheme, host, or port seen by the application, reconstruct the original URL before validation.

Keep the response contract for each URL explicit. A normal CallbackUrl can acknowledge the interaction after recording it. An InterceptCallbackUrl should return 403 only when the communication must be blocked, since a timeout permits it. An out-of-session route should return TwiML or auto-create JSON only after deciding how that unmatched call or message should proceed.

Limit logging because callback fields can contain participant and proxy phone numbers. Remove the callback URLs or disable the Proxy Service when the integration should stop. A robots.txt directive cannot protect these endpoints and should not be used as a substitute for signature validation.

Examples

A rider messages a proxy number during an open Session. Proxy maps the number to the driver, forwards the message, and posts the resulting interaction fields to `CallbackUrl`.
An `InterceptCallbackUrl` verifies Twilio's signature, finds that the Session is suspended, and returns 403. Proxy aborts that interaction.
A caller reaches a pooled number after the prior Session has closed. The out-of-session endpoint returns auto-create Session JSON that connects the caller to the intended participant.

Frequently asked questions about Twilio Proxy

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

It maps each participant's real phone identifier to a proxy identifier within a Session, so calls and messages can be routed without exposing the other participant's number.