Summary

voice-call with Twilio requires you provide Twilio a webhook url so Twilio can request instructions about the call and update voice-call with status. When that webhook url contains a port (e.g. https://my.server.com:8443/), the webhook will fail. This is because voice-call tries to verify the x-twilio-signature header with a different algorithm than what Twilio uses. When voice-call sees the signature mis-match, it returns a 401 to Twilio and the call fails.

Steps to reproduce

1. Setup voice-call skill with Twilio
2. Create a Twilio webhook back to voice-call that contains a port (e.g. 80, 443, 8443, 3340)
3. Try to make a call via voice-call skill and note that the Twilio logs show a 401 and the call fails.

Expected behavior

x-twilio-signature verification in voice-call should match the signature provided by Twilio. We should check the signature the exact same way Twilio's official signature verification works by either using the Twilio library or accepting signatures generated with and without the port.

Actual behavior

Twilio generates the signature hash by using a URL without the port specifier. voice-call generates the signature hash with the port. The signatures don't match.

Environment

• Clawdbot version: Openclaw 2026-1-30
• OS: Linux
• Install method (pnpm/npx/docker/etc): pnpm

Logs or screenshots

Line 132 here shows the official Twilio package testing the signature with and without a port.
This line in voice-call just uses the URL as-is without testing with/without the port.