@AI Evy Tagging you

### Answer --- The available sources cover function calling concepts and configuration at a high level [(1) ]() , but don't include specific details on how to compute the webhook signature hash digest for custom functions in PHP (or any language) . For webhook signature verification implementation details, I'd recommend checking: - [Function Calling Overview]() for general function calling setup For the specific signature hash computation logic, you'll likely need to consult additional documentation or reach out for support: - Visit [Contact Sales]() - Visit [) Would you like me to try providing a general answer about webhook signature verification patterns if you'd find that helpful?

​ To learn more, see the sources I considered: [[1] Function Calling Overview](https://docs.retellai.com/build/single-multi-prompt/function-calling) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer --- To verify webhooks from Retell AI, you use the

x-retell-signature

header together with your Retell API Key. [(1) ]() Key points: - Only the API key that has a webhook badge next to it can be used to verify the webhook. - You can also allowlist Retell's IP address:

100.20.5.228

. Signature format: The

X-Retell-Signature

header follows this format:

v=<timestamp>,d=<signature>

[(2) ]() -

v=

contains the timestamp (in milliseconds) -

d=

contains the HMAC-SHA256 digest How to compute the signature: Based on the Ruby example provided by Retell support, the signed message is constructed as:

message = "#{timestamp}.#{raw_body}"
expected_digest = OpenSSL::HMAC.hexdigest("sha256", secret, message)

Important notes for implementation: 1. Use the full API key as the secret — don't remove the "key_" prefix 2. The timestamp in the signature is in milliseconds 3. The raw request body should be used exactly as received Recommended approach: Retell provides verify functions in their official SDKs (Node.js and Python) . The Node.js example: [(1) ]()

javascript
import { Retell } from "retell-sdk";

if (
  !Retell.verify(
    JSON.stringify(req.body) ,
    process.env.RETELL_API_KEY,
    req.headers["x-retell-signature"] as string,
  )
) {
  console.error("Invalid signature") ;
  return;
}

For PHP specifically, there isn't an official SDK example in the documentation. Based on the signature format, you would need to implement HMAC-SHA256 verification using

hash_hmac('sha256', $message, $apiKey)

where

$message

is

"{timestamp}.{rawBody}"

. However, some users have reported difficulties getting custom implementations to match. [(3) ]() , [(2) ]() For the most reliable PHP implementation, I'd suggest reviewing the official SDK source code on GitHub or reaching out for support.

​ To learn more, see the sources I considered: [[1] Secure the webhook](https://docs.retellai.com/features/secure-webhook) [[2] Webhook Verification](https://discord.com/channels/1186424376300679209/1400483295082451026) [[3] Webhook Signature Verification Failed](https://discord.com/channels/1186424376300679209/1399212780183097498) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.