Skip to Content
WebhooksBest Practices

Best Practices

Pacing

Don’t fire calls faster than you can handle the answers.

  • Put a delay between consecutive triggers rather than bursting
  • Use a queue for high-volume scenarios
  • Watch your usage and balance in the dashboard

Firing many calls back-to-back from one number also damages that number’s reputation with carriers, which shows up later as calls being flagged or blocked. For volume, use an outbound campaign — it has call pacing and calling-window controls built in.

Security

The webhook URL is a credential. Anyone who has it can make your agent call any number.

  • Store it as an environment variable or in your secret manager, never in client-side code or a shared document
  • Use HTTPS only
  • Watch for unusual activity in your call history
  • If a URL may have leaked, treat it as compromised

A webhook URL is a bearer secret with no scopes and no signature. The Calls API authenticates with a scoped API key you can revoke and re-scope, and delivers signed completion webhooks you can verify came from Dialora. If you’re writing code anyway, use it.

Reliability

  • Validate before you send. Check the number parses and includes a country code, rather than letting the call fail.
  • Handle non-2xx responses. Log the body — it tells you what was wrong with the payload.
  • Don’t retry blindly. A retried trigger places a second real call to a real person. Make sure a retry is what you actually want.
  • Test after every agent change. A published prompt change alters what your webhook-triggered calls say.

Respect the recipient

  • Only call people who’ve consented to be called
  • Honour opt-outs immediately — block numbers you shouldn’t call again (Phone Number Blocking)
  • Keep to reasonable local hours for the person you’re calling, not for you