Function verifyTwilioSignature

verifyTwilioSignature(
    authToken: string,
    signatureHeader: string,
    url: string,
    params: Record<string, string>,
): boolean
Verifies a Twilio webhook request signature per Twilio's documented scheme:
1. Start from the full request URL (scheme + host + path + query, exactly as Twilio called it).
2. Append each POST param, sorted by parameter name, as key + value concatenated (no separators).
3. HMAC-SHA1 the resulting string with the account Auth Token as the key; base64-encode the digest.
4. Constant-time-compare against the X-Twilio-Signature header.
A missing/empty signature header rejects. Comparison is constant-time (timingSafeEqual) to avoid leaking the expected signature via timing. Pure + exported so it unit-tests with a known vector and the MJAPI router calls it on every public Twilio endpoint (these can't carry an MJ JWT).
Parameters
- authToken: string
  The Twilio account Auth Token (the HMAC key; resolved upstream — never inlined).
- signatureHeader: string
  The X-Twilio-Signature request header value.
- url: string
  The full request URL exactly as Twilio invoked it.
- params: Record<string, string>
  The POST form parameters Twilio sent.
Returns boolean
true when the signature is valid; false otherwise (including a missing header).
- Defined in Providers/Twilio/src/twilio-ingress.ts:38