Why the result arrives later
A call request can be accepted before the conversation starts or finishes. End-of-call events update the call record, transcript, duration, and usage after the provider reports them. Messaging status callbacks can arrive separately as a message moves through its delivery states.
Configured endpoints
The application includes provider handlers under /api/webhooks/vapi, /api/webhooks/twilio, and /api/webhooks/stripe. Configure each provider with the correct public URL and its required authentication or signing settings. Never expose an unverified endpoint simply to make a test event pass.
Authenticate before processing
Use the verification method for the specific provider. Vapi uses the configured x-vapi-secret header or Bearer secret; a custom x-vapi-signature HMAC is supported only under the configured contract. A shared-secret header, an HMAC signature, and Twilio's request signature are different mechanisms. Verification must happen against the original payload and the correct externally visible URL where the provider requires it.
Treat retries as normal
Providers may deliver the same event more than once. The application uses event identifiers and database operations designed to prevent duplicate processing. An event that has already been handled must not create a second call charge or repeat the same ledger movement.
Usage and credit updates
Duration and message usage should come from verified events, not a number supplied by the browser. Call minutes and SMS usage can then be associated with the correct organization and billing record. Review the units, rounding, and configured meter before a live billing launch.
Your own downstream workflow
If you need call outcomes sent to a separate business system, scope that connection and its signing contract explicitly. A provider callback endpoint in this application does not by itself mean a custom outbound webhook subscription has been configured for your system.
Continue to Webhook signing and Billing and usage.