Skip to main content
By default every phone number and publishable key has a static agent assigned. When you need per-caller or per-visitor customization — VIP routing, logged-in user context, A/B prompt tests — switch to webhook-mode and let your server decide.

​
How it works

  1. You subscribe to the telephony.incoming (phone) or web.incoming (widget) event. Both are blocking webhooks: ThunderPhone waits up to two seconds for your response before continuing the call.
  2. ThunderPhone sends you {call_id, from_number, to_number}.
  3. Your server responds with an agent configuration (prompt, voice, product, tools). ThunderPhone uses that configuration for the call.
  4. If you return {}, time out, or error, the statically-assigned agent is used as a fallback. Safe default.
Works identically for phone calls (telephony.incoming) and widget sessions (web.incoming). The legacy single-URL webhook uses the event name call.incoming for both.

​
1. Configure the webhook destination

For phone numbers, subscribe your endpoint to telephony.incoming:
curl -X POST https://api.thunderphone.com/v1/developer/webhook-endpoints \
  -H "Authorization: Bearer sk_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "label":  "Prod call-incoming",
    "url":    "https://example.com/thunderphone/incoming",
    "events": ["telephony.incoming"]
  }'
The response includes a one-shot secret — save it; you’ll use it for signature verification.

​
2. Implement the handler

Three rules of thumb:
  • Verify the signature on every request (see Verify webhook signatures). Don’t skip this in dev — get it right once and reuse.
  • Respond fast. Two seconds is the hard cap. Do database lookups if you need to, but don’t call downstream LLMs synchronously — if you want dynamic prompt generation, pre-compute and cache.
  • Fall back cleanly. Any unexpected state should return {} so the statically-assigned agent handles the call.
import hashlib
import hmac
import json
import os

from fastapi import FastAPI, HTTPException, Request

app = FastAPI()
SECRET = os.environ["THUNDERPHONE_WEBHOOK_SECRET"]

def verify(body: bytes, sig: str) -> bool:
    expected = hmac.new(SECRET.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig or "")

@app.post("/thunderphone/incoming")
async def incoming(request: Request):
    body = await request.body()
    if not verify(body, request.headers.get("X-ThunderPhone-Signature", "")):
        raise HTTPException(401)

    event = json.loads(body)
    if event["type"] not in ("telephony.incoming", "web.incoming", "call.incoming"):
        return {}  # fall back to default

    caller = event["data"]["from_number"]
    # Cheap DB lookup: is this a known VIP?
    customer = lookup_customer(caller)
    if customer and customer.tier == "vip":
        return {
            "prompt":  f"You are a VIP concierge for {customer.name}. Be proactive…",
            "voice":   "en-US-James1",
            "product": "storm-base",
        }
    return {}  # default agent handles non-VIPs

def lookup_customer(phone: str):
    # ... your CRM integration ...
    pass

​
3. Response schema

The response body matches the call.incoming schema exactly. The commonly-used fields:
FieldTypeDescription
promptstring (required)System prompt for the agent
voicestring (required)Voice id from GET /v1/voices
productstringDefaults to spark
background_trackstring | nullAmbient audio id
acknowledgement_prompt_modestringauto or manual (Storm-with-ack only)
acknowledgement_promptstringRequired when mode is manual
toolsarrayInline function-tool schemas — see Function Tools
Per-call speak-order and max_hold_seconds aren’t available on the webhook response. Set them on the Agent you reference.

​
Patterns

​
Logged-in user context

In webhook-mode widgets, the visitor’s page already knows who they are. Call your webhook with a query string parameter the widget SDK forwards (?customer_id=123) and look up the customer server-side.

​
A/B prompt rollout

Hash call_id → bucket; serve prompt A for 0..49 and prompt B for 50..99. Record which bucket you chose in your own DB and later correlate against call.complete’s grade_score.

​
Time-based routing

Business hours → “live support” agent; after-hours → “take a message” agent. Pure switch on new Date().getUTCHours() in your handler.

​
Next steps

call.incoming reference

Exact request + response schemas, including every configuration key.

Verify webhook signatures

Get the HMAC right once; reuse everywhere.

Build a tool integration

Combine dynamic routing with per-agent tools.

Delivery semantics

Retries, ordering, timeouts.