Dynamic per-call configuration
Pick the answering agent — or rewrite its prompt and settings — separately for every incoming call, driven by custom logic in a webhook you control.
By default every phone number and publishable key has a static agent assigned. When you need per-caller or per-visitor customization — VIP routing, logged-in user context, A/B prompt tests — switch to webhook-mode and let your server decide.
How it works
- You subscribe to the
telephony.incoming(phone) orweb.incoming(widget) event. Both are blocking webhooks: ThunderPhone waits up to 10 seconds for your response before continuing the call. - ThunderPhone sends you
{call_id, from_number, to_number}(widget sessions carry widget-specific fields instead of numbers — see the request schema). - Your server responds with an agent configuration (prompt, voice, product, tools). ThunderPhone uses that configuration for the call.
- If you return
{}, time out, or error, the statically-assigned agent is used as a fallback. Safe default.
1. Configure the webhook destination
For phone numbers, subscribe your endpoint to telephony.incoming:
curl -X POST https://api.thunderphone.com/v1/developer/webhook-endpoints \
-H "Authorization: Bearer sk_live_YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"label": "Prod call-incoming",
"url": "https://example.com/thunderphone/incoming",
"events": ["telephony.incoming"]
}'The response includes a one-shot secret — save it; you'll use it
for signature verification.
For widget sessions, create a publishable key in mode="webhook"
with your endpoint URL baked in:
curl -X POST https://api.thunderphone.com/v1/publishable-key \
-H "Authorization: Bearer sk_live_YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Dynamic widget",
"mode": "webhook",
"webhook_url": "https://example.com/thunderphone/widget-incoming",
"allowed_domains": ["example.com"]
}'The widget will POST to this URL on every session start.
2. Implement the handler
Three rules of thumb:
- Verify the signature on every request (see Verify webhook signatures). Don't skip this in dev — get it right once and reuse.
- Respond fast. Ten seconds is the hard cap, and every second is dead air for the caller. Do database lookups if you need to, but don't call downstream LLMs synchronously — if you want dynamic prompt generation, pre-compute and cache.
- Fall back cleanly. Any unexpected state should return
{}so the statically-assigned agent handles the call.
import hashlib
import hmac
import json
import os
from fastapi import FastAPI, HTTPException, Request
app = FastAPI()
SECRET = os.environ["THUNDERPHONE_WEBHOOK_SECRET"]
def verify(body: bytes, sig: str) -> bool:
expected = hmac.new(SECRET.encode(), body, hashlib.sha256).hexdigest()
return hmac.compare_digest(expected, sig or "")
@app.post("/thunderphone/incoming")
async def incoming(request: Request):
body = await request.body()
if not verify(body, request.headers.get("X-ThunderPhone-Signature", "")):
raise HTTPException(401)
event = json.loads(body)
if event["type"] not in ("telephony.incoming", "web.incoming"):
return {} # fall back to default
caller = event["data"]["from_number"]
# Cheap DB lookup: is this a known VIP?
customer = lookup_customer(caller)
if customer and customer.tier == "vip":
return {
"prompt": f"You are a VIP concierge for {customer.name}. Be proactive…",
"voice": "john",
"product": "storm-base",
}
return {} # default agent handles non-VIPs
def lookup_customer(phone: str):
# ... your CRM integration ...
passimport crypto from "node:crypto";
import express from "express";
const app = express();
const SECRET = process.env.THUNDERPHONE_WEBHOOK_SECRET;
function verify(body, sig) {
const expected = crypto.createHmac("sha256", SECRET).update(body).digest("hex");
return sig &&
crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}
app.post(
"/thunderphone/incoming",
express.raw({ type: "application/json" }),
async (req, res) => {
if (!verify(req.body, req.header("X-ThunderPhone-Signature"))) {
return res.sendStatus(401);
}
const event = JSON.parse(req.body.toString("utf8"));
const IMPORTANT_TYPES = new Set([
"telephony.incoming",
"web.incoming",
]);
if (!IMPORTANT_TYPES.has(event.type)) return res.json({});
const customer = await lookupCustomer(event.data.from_number);
if (customer?.tier === "vip") {
return res.json({
prompt: `You are a VIP concierge for ${customer.name}. Be proactive…`,
voice: "john",
product: "storm-base",
});
}
res.json({}); // fall back to default agent
},
);3. Response schema
The response body matches the incoming-call response schema exactly. The commonly-used fields:
| Field | Type | Description |
|---|---|---|
prompt | string (required) | System prompt for the agent |
voice | string (required) | Voice id from GET /v1/voices |
product | string | Defaults to spark |
background_track | string | null | Ambient audio id |
acknowledgement_prompt_mode | string | auto or manual (Storm-with-ack only) |
acknowledgement_prompt | string | Required when mode is manual |
tools | array | Inline function-tool schemas — see Function Tools |
Patterns
Logged-in user context
In webhook-mode widgets, the visitor's page already knows who they
are. Call your webhook with a query string parameter the widget SDK
forwards (?customer_id=123) and look up the customer server-side.
A/B prompt rollout
Before you hand-roll this, note that ThunderPhone has a native
Experiments feature
(/dashboard/experiments and the agent builder's A/B tab) that
defines variants, splits traffic, and compares outcomes per variant —
no webhook required.
If you need webhook-side control anyway: hash call_id → bucket;
serve prompt A for 0..49 and prompt B for 50..99. Record which
bucket you chose in your own DB and later correlate against the
completed call's grade.
Time-based routing
Business hours → "live support" agent; after-hours → "take a message"
agent. Pure switch on new Date().getUTCHours() in your handler.