I have an Azure App Service running a .NET (Core) API for an inhouse application, which I'm integrating with Twilio to handle Whatsapp communication.

To handle the web hook responsible for receiving a message, I can't think of a secure way to allow communication to my API, and thus thought that I could build an Azure Function which authenticates with Entra ID using the Client Credentials Flow to be able to hit an endpoint on my API.

Then, I'd be able to specify my function endpoint with its code/key as the URL for the message receiving web hook in Twilio.

Is this the best practice for designing such a feature?

Thanks in advance.

1 Answer 1


As Murphy's Law goes, I think I've stumbled onto my answer.

Twilio has a list of security recommendations on the following document, where they stipulate that you should verify any request before processing it.

You can do this by checking the x-twilio-signature HTTP header to match it against your Twilio-issued auth key, meaning this can be done by having an exposed endpoint on an App Service .NET API, as long as that endpoint is secured with the recommendations from the document.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.