Best Practices
Pacing
Don’t fire calls faster than you can handle the answers.
- Put a delay between consecutive triggers rather than bursting
- Use a queue for high-volume scenarios
- Watch your usage and balance in the dashboard
Firing many calls back-to-back from one number also damages that number’s reputation with carriers, which shows up later as calls being flagged or blocked. For volume, use an outbound campaign — it has call pacing and calling-window controls built in.
Security
The webhook URL is a credential. Anyone who has it can make your agent call any number.
- Store it as an environment variable or in your secret manager, never in client-side code or a shared document
- Use HTTPS only
- Watch for unusual activity in your call history
- If a URL may have leaked, treat it as compromised
A webhook URL is a bearer secret with no scopes and no signature. The Calls API authenticates with a scoped API key you can revoke and re-scope, and delivers signed completion webhooks you can verify came from Dialora. If you’re writing code anyway, use it.
Reliability
- Validate before you send. Check the number parses and includes a country code, rather than letting the call fail.
- Handle non-2xx responses. Log the body — it tells you what was wrong with the payload.
- Don’t retry blindly. A retried trigger places a second real call to a real person. Make sure a retry is what you actually want.
- Test after every agent change. A published prompt change alters what your webhook-triggered calls say.
Respect the recipient
- Only call people who’ve consented to be called
- Honour opt-outs immediately — block numbers you shouldn’t call again (Phone Number Blocking)
- Keep to reasonable local hours for the person you’re calling, not for you