​ To learn more, see the sources I considered: [[1] Secure the webhook](https://docs.retellai.com/features/secure-webhook) ​

### Answer You can secure your agent-level webhook using the

x-retell-signature

header together with your Retell API Key to verify the webhook comes from Retell AI. [(1) ]() How to verify: Use the SDK's built-in

verify

function. Only the API key that has a webhook badge next to it can be used to verify the webhook. You can also allowlist Retell's IP address:

100.20.5.228

Example (Node.js) :

javascript
import { Retell } from "retell-sdk";
import express, { Request, Response } from "express";

const app = express() ;
app.use(express.json() ) ;

app.post("/webhook", (req: Request, res: Response) => {
  if (
    !Retell.verify(
      JSON.stringify(req.body) ,
      process.env.RETELL_API_KEY,
      req.headers["x-retell-signature"] as string,
    )
  ) {
    console.error("Invalid signature") ;
    return;
  }
  const {event, call} = req.body;
  // process the webhook
  // Acknowledge the receipt of the event
  res.status(204) .send() ;
}) ;

So while the dashboard UI only shows a URL field, you secure it on your server side by validating the signature header on incoming requests.

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.