Prevent Abuse

​

API Key Security

​

Webhook Validation

import hmac
import hashlib

def verify_webhook(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

• Allowlist DialNexa’s IP ranges: Restrict your webhook endpoint to only accept connections from DialNexa’s published IP ranges. Contact support for the current list.
• Use HTTPS only: Never configure a webhook URL using plain HTTP. All webhook URLs must use TLS.
• Implement idempotency: Webhooks may be delivered more than once in edge cases. Use the call_id field as an idempotency key to avoid processing the same event twice.
• Set a short timeout: Respond to webhook requests within 5 seconds. Slow responses can cause the agent to stall on the call.

​

Restricting Outbound Numbers and Destinations

​

Rate Limiting Your API Usage

# Example: token bucket rate limiter in your application

from datetime import datetime, timedelta

class CallRateLimiter:
    def __init__(self, max_calls_per_minute: int):
        self.max_calls = max_calls_per_minute
        self.calls = []
    
    def can_call(self) -> bool:
        now = datetime.utcnow()
        # Remove calls older than 1 minute
        self.calls = [c for c in self.calls if now - c < timedelta(minutes=1)]
        if len(self.calls) < self.max_calls:
            self.calls.append(now)
            return True
        return False

​

Concurrency Caps

1. Go to Settings → Plan → Concurrency
2. Set an active concurrency limit lower than your plan’s maximum if your normal operations don’t need the full limit
3. For batch campaigns, set a campaign-level concurrency limit in the campaign settings

​

Securing Agent Webhooks from Prompt Injection

• Validate all arguments: Never trust tool call arguments at face value. Validate types, formats, and value ranges before executing any database queries or external API calls.
• Use parameterized queries: If a tool executes database queries, always use parameterized queries. Never construct SQL or NoSQL queries from raw LLM-generated strings.
• Scope permissions tightly: The credentials used by your tool endpoints should have only the minimum permissions needed. A booking tool should only be able to write to the appointments table, not query user records.
• Log all tool invocations: Log every tool call with its arguments and the call ID. This creates an audit trail for investigating abuse.

​

Environment Isolation

• Use separate DialNexa accounts or workspaces for each environment
• Use separate API keys per environment - never use a production key in development
• Use separate phone numbers per environment - test calls should never go out on production numbers
• Use separate webhook endpoints per environment

​

Monitoring for Abuse

• Daily cost alert: Configure a daily spend alert in Settings → Billing → Alerts. If your daily spend exceeds 2x your normal daily average, get notified immediately.
• Failed call ratio alert: A spike in failed outbound calls often indicates a bad number list or misconfigured campaign. Monitor the failed/succeeded ratio in dashboard metrics.
• API error rate: A high rate of API 4xx errors (especially 401 Unauthorized) may indicate someone probing your endpoints with invalid credentials.

​

Checklist Before Going to Production

​

Related Pages

• Fraud Protection - platform-level fraud detection
• API Keys - creating and managing API keys
• Billing - spend alerts and wallet management