Issue

When using Twilio Programmable Voice with regional routing (such as AU1 for Australia), you may encounter inbound calls that fail with the message:
“We’re sorry, an application error has occurred.”
This issue may not occur when routing through the default (US1) region, and calls may work as expected when switched back to US1.

This article explains the root cause, how to diagnose, and how to resolve this issue, especially when it relates to webhook validation and Twilio signature verification.

Symptoms

• Inbound calls to a Twilio number routed via a regional edge (e.g., AU1) fail with an application error.
• The same number works when routed through US1.
• Your application server receives Twilio’s webhook request but responds with HTTP 403 Unauthorized: Invalid Twilio signature error.
• Media Streams (e.g., WebSocket connections) are not initiated because the call flow fails at the webhook validation step.

How to Diagnose

1. Check Your Server Logs:
   Look for HTTP 403 errors with messages like “Invalid Twilio signature” when calls are routed via AU1.
2. Compare Behavior:
   • Calls routed via US1 succeed.
   • Calls routed via AU1 fail at the webhook step.
3. Review Twilio Console:
   • Confirm that the Voice webhook URL is correct for both regions.
   • Check for error codes such as 11200, 12100, 12200 (application/webhook errors).

Product

Programmable Voice

Environment

Twilio Console

Cause

Twilio uses regional authentication tokens when dispatching webhook requests from regional edges (such as AU1).
If your server validates the X-Twilio-Signature header using only your global (US1) Auth Token, it will reject requests signed with a regional token, resulting in a 403 Unauthorized error.

Key Points:

• US1 requests are signed with your global Auth Token.
• AU1 (and other regional) requests are signed with the corresponding regional Auth Token.
• If your webhook validator does not recognize the regional token, it will reject the request.

Resolution

Update your webhook signature validation logic to accept the regional Auth Token for the region in use.

1. Locate Your Regional Auth Tokens:
   • In the Twilio Console, navigate to your account’s Auth Tokens section.
   • Find the token for the region (e.g., AU1) you are using.
2. Update Your Server’s Validator:
   • Ensure your webhook validator checks the X-Twilio-Signature using the correct Auth Token for the region from which the request originated.
   • Twilio’s SDKs and helper libraries support regional token validation. Refer to the documentation for your programming language.
3. Test Inbound Calls:
   • Route calls through the regional edge (e.g., AU1) and confirm that your server now accepts the webhook request and the call completes as expected.
4. Reference Documentation:
   • How to Validate Twilio Requests with Regional Auth Tokens

Additional Information

• If you use Media Streams, the WebSocket connection will only be attempted after successful webhook validation. Fixing the signature validation will allow the full call flow to proceed.
• This issue can affect any region (e.g., AU1, IE1, SG1) if the regional Auth Token is not recognized by your server.

Below you will find references to useful documents:

• Twilio Regional Authentication Tokens
• Securing Your Webhooks with Twilio Signatures
• Twilio Programmable Voice Regions

Summary Table