### Answer --- Regarding webhook signature verification: Yes, you can use the

x-retell-signature

header together with your Retell API Key to verify webhooks come from Retell AI. [(1) ]() Key points: 1. Only the API key with a webhook badge can be used to verify webhooks 2. You can also allowlist Retell's IP address:

100.20.5.228

3. Retell provides SDK

verify

functions in Node.js and Python Regarding consistency concerns: Community reports indicate there have been occasional signature verification failures. [(2) ]() [(3) ]() One known cause is when transcripts contain special characters (e.g., accented characters like "Buendía") . Adding

ensure_ascii=False

to JSON dumps has been reported to help. [(2) ]() The critical requirement for verification to work: **use the raw request body string exactly as received**—do not re-serialize or modify the payload before checking, as Retell signs the exact raw request body. [(3) ]() Sample verification code (Node.js) :

javascript
if (
  !Retell.verify(
    JSON.stringify(req.body) ,
    process.env.RETELL_API_KEY,
    req.headers["x-retell-signature"] as string,
  )
) {
  console.error("Invalid signature") ;
  return;
}

[(1) ]() Recommendation: Given the documented edge cases with special characters, your current non-blocking approach (logging failures but continuing) is reasonable until you can confirm your specific use case doesn't trigger these issues. If you want to make it blocking, ensure you're handling the raw body correctly and test with various transcript content types.

​ To learn more, see the sources I considered: [[1] Secure the webhook](https://docs.retellai.com/features/secure-webhook) [[2] Webhook signature fails verification](https://discord.com/channels/1186424376300679209/1257584657172529183) [[3] Webhook verification failure](https://discord.com/channels/1186424376300679209/1359570824461418627) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer --- Yes, Retell sends the

x-retell-signature

header to webhook endpoints, and you should validate signatures on all endpoints receiving Retell webhooks. Based on the documentation: 1. Call Event Webhooks (like

call_started

,

call_ended

,

call_analyzed

) use the same signature mechanism—you can use the

x-retell-signature

header with your webhook-badged API key to verify authenticity. [(1) ]() 2. Custom Function webhooks also receive the

X-Retell-Signature

header for verification. The custom function documentation shows signature validation in the sample code:

python
valid_signature = retell.verify(
    json.dumps(post_data, separators=(",", ":") , ensure_ascii=False) ,
    api_key=str(os.environ["RETELL_API_KEY"]) ,
    signature=str(request.headers.get("X-Retell-Signature") ) ,
)

[(2) ]() Recommendation: Your

retell-call-webhook

endpoint should also implement signature validation using the same approach as your

retell-webhook-handler

. You can additionally allowlist Retell's IP address (

100.20.5.228

) as a secondary security measure. [(1) ]() [(2) ]() ---

​ To learn more, see the sources I considered: [[1] Secure the webhook](https://docs.retellai.com/features/secure-webhook) [[2] Custom Function](https://docs.retellai.com/build/conversation-flow/custom-function) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.