> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thunderphone.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Dynamic per-call configuration
> Pick an agent — or rewrite a prompt — per incoming call based on custom logic in a webhook.
By default every phone number and publishable key has a static agent
assigned. When you need **per-caller** or **per-visitor** customization
— VIP routing, logged-in user context, A/B prompt tests — switch to
webhook-mode and let your server decide.
## How it works
1. You subscribe to the [`telephony.incoming`](/webhooks/events#telephony-incoming)
(phone) or [`web.incoming`](/webhooks/events#web-incoming) (widget)
event. Both are **blocking** webhooks: ThunderPhone waits up to
10 seconds for your response before continuing the call.
2. ThunderPhone sends you `{call_id, from_number, to_number}` (widget
sessions carry widget-specific fields instead of numbers — see the
[request schema](/webhooks/call-incoming)).
3. Your server responds with an agent configuration (prompt, voice,
product, tools). ThunderPhone uses that configuration for the call.
4. If you return `{}`, time out, or error, the statically-assigned
agent is used as a fallback. Safe default.
Works identically for phone calls (`telephony.incoming`) and widget
sessions (`web.incoming`), whether delivered to a webhook endpoint
or to the legacy single-URL webhook.
## 1. Configure the webhook destination
For phone numbers, subscribe your endpoint to `telephony.incoming`:
```bash theme={null}
curl -X POST https://api.thunderphone.com/v1/developer/webhook-endpoints \
-H "Authorization: Bearer sk_live_YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"label": "Prod call-incoming",
"url": "https://example.com/thunderphone/incoming",
"events": ["telephony.incoming"]
}'
```
The response includes a one-shot `secret` — save it; you'll use it
for signature verification.
For widget sessions, create a publishable key in `mode="webhook"`
with your endpoint URL baked in:
```bash theme={null}
curl -X POST https://api.thunderphone.com/v1/publishable-key \
-H "Authorization: Bearer sk_live_YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Dynamic widget",
"mode": "webhook",
"webhook_url": "https://example.com/thunderphone/widget-incoming",
"allowed_domains": ["example.com"]
}'
```
The widget will POST to this URL on every session start.
## 2. Implement the handler
Three rules of thumb:
* **Verify the signature** on every request (see
[Verify webhook signatures](/guides/verify-webhook-signatures)).
Don't skip this in dev — get it right once and reuse.
* **Respond fast**. Ten seconds is the hard cap, and every second is
dead air for the caller. Do database lookups if you need to, but
don't call downstream LLMs synchronously — if you want dynamic
prompt generation, pre-compute and cache.
* **Fall back cleanly**. Any unexpected state should return `{}` so
the statically-assigned agent handles the call.
```python FastAPI theme={null}
import hashlib
import hmac
import json
import os
from fastapi import FastAPI, HTTPException, Request
app = FastAPI()
SECRET = os.environ["THUNDERPHONE_WEBHOOK_SECRET"]
def verify(body: bytes, sig: str) -> bool:
expected = hmac.new(SECRET.encode(), body, hashlib.sha256).hexdigest()
return hmac.compare_digest(expected, sig or "")
@app.post("/thunderphone/incoming")
async def incoming(request: Request):
body = await request.body()
if not verify(body, request.headers.get("X-ThunderPhone-Signature", "")):
raise HTTPException(401)
event = json.loads(body)
if event["type"] not in ("telephony.incoming", "web.incoming"):
return {} # fall back to default
caller = event["data"]["from_number"]
# Cheap DB lookup: is this a known VIP?
customer = lookup_customer(caller)
if customer and customer.tier == "vip":
return {
"prompt": f"You are a VIP concierge for {customer.name}. Be proactive…",
"voice": "john",
"product": "storm-base",
}
return {} # default agent handles non-VIPs
def lookup_customer(phone: str):
# ... your CRM integration ...
pass
```
```javascript Express theme={null}
import crypto from "node:crypto";
import express from "express";
const app = express();
const SECRET = process.env.THUNDERPHONE_WEBHOOK_SECRET;
function verify(body, sig) {
const expected = crypto.createHmac("sha256", SECRET).update(body).digest("hex");
return sig &&
crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}
app.post(
"/thunderphone/incoming",
express.raw({ type: "application/json" }),
async (req, res) => {
if (!verify(req.body, req.header("X-ThunderPhone-Signature"))) {
return res.sendStatus(401);
}
const event = JSON.parse(req.body.toString("utf8"));
const IMPORTANT_TYPES = new Set([
"telephony.incoming",
"web.incoming",
]);
if (!IMPORTANT_TYPES.has(event.type)) return res.json({});
const customer = await lookupCustomer(event.data.from_number);
if (customer?.tier === "vip") {
return res.json({
prompt: `You are a VIP concierge for ${customer.name}. Be proactive…`,
voice: "john",
product: "storm-base",
});
}
res.json({}); // fall back to default agent
},
);
```
## 3. Response schema
The response body matches the
[incoming-call response schema](/webhooks/call-incoming#response-schema)
exactly. The commonly-used fields:
| Field | Type | Description |
| ----------------------------- | ----------------- | -------------------------------------------------------------------- |
| `prompt` | string (required) | System prompt for the agent |
| `voice` | string (required) | Voice id from [`GET /v1/voices`](/api-reference/agents#voices) |
| `product` | string | Defaults to `spark` |
| `background_track` | string \| null | Ambient audio id |
| `acknowledgement_prompt_mode` | string | `auto` or `manual` (Storm-with-ack only) |
| `acknowledgement_prompt` | string | Required when mode is `manual` |
| `tools` | array | Inline function-tool schemas — see [Function Tools](/tools/overview) |
Per-call speak-order and `max_hold_seconds` aren't available on the
webhook response. Set them on the
[Agent](/api-reference/agents) you reference.
## Patterns
### Logged-in user context
In webhook-mode widgets, the visitor's page already knows who they
are. Call your webhook with a query string parameter the widget SDK
forwards (`?customer_id=123`) and look up the customer server-side.
### A/B prompt rollout
Before you hand-roll this, note that ThunderPhone has a native
[Experiments](/guides/concepts#experiments) feature
(`/dashboard/experiments` and the agent builder's **A/B** tab) that
defines variants, splits traffic, and compares outcomes per variant —
no webhook required.
If you need webhook-side control anyway: hash `call_id` → bucket;
serve prompt A for `0..49` and prompt B for `50..99`. Record which
bucket you chose in your own DB and later correlate against the
completed call's grade.
### Time-based routing
Business hours → "live support" agent; after-hours → "take a message"
agent. Pure switch on `new Date().getUTCHours()` in your handler.
***
## Next steps
Exact request + response schemas, including every configuration key.
Get the HMAC right once; reuse everywhere.
Combine dynamic routing with per-agent tools.
Retries, ordering, timeouts.