Voice-call plugin: "invalid token" with Cloudflare Tunnel
Voice-call plugin: "invalid token" with Cloudflare Tunnel
Setup: Twilio + voice-call plugin + Cloudflare named tunnel (not ngrok)
publicUrl set to https://voice.mydomain.com/voice/webhook (NOT GIVING OUT MY REAL INFO HERE
skipSignatureVerification: true
streaming.enabled: true
One-way notify calls work perfectly — HTTP webhooks go through the tunnel fine, Twilio gets TwiML back, I hear audio. So the tunnel and webhook path are solid.
The issue is only with two-way conversation calls (media streaming). The WebSocket connects successfully through the tunnel:
[voice-call] WebSocket upgrade for media stream
[MediaStream] Twilio connected
[MediaStream] Stream started: [streamSid] (call: [callSid])
But then the plugin immediately rejects it:
[voice-call] Rejecting media stream: invalid token for [callSid]
[MediaStream] Rejecting stream for unknown call: [callSid]
Twilio error 31921 (remote server closed WebSocket). Call ends instantly (0 duration). Happens for both inbound and outbound calls.
I checked the plugin source — getStreamConnectXml in twilio.ts generates the TwiML with no token parameter in the Stream URL (just wss://voice.mydomain.com/voice/stream). Yet the runtime rejects with "invalid token", so the validation seems to happen somewhere outside the visible TypeScript source.
Is there a config flag to disable stream token validation? Or is this a known issue with external tunnels?
OpenClaw 2026.2.3-1, Windows, Node 24
Setup: Twilio + voice-call plugin + Cloudflare named tunnel (not ngrok)
publicUrl set to https://voice.mydomain.com/voice/webhook (NOT GIVING OUT MY REAL INFO HERE
skipSignatureVerification: true
streaming.enabled: true
One-way notify calls work perfectly — HTTP webhooks go through the tunnel fine, Twilio gets TwiML back, I hear audio. So the tunnel and webhook path are solid.
The issue is only with two-way conversation calls (media streaming). The WebSocket connects successfully through the tunnel:
[voice-call] WebSocket upgrade for media stream
[MediaStream] Twilio connected
[MediaStream] Stream started: [streamSid] (call: [callSid])
But then the plugin immediately rejects it:
[voice-call] Rejecting media stream: invalid token for [callSid]
[MediaStream] Rejecting stream for unknown call: [callSid]
Twilio error 31921 (remote server closed WebSocket). Call ends instantly (0 duration). Happens for both inbound and outbound calls.
I checked the plugin source — getStreamConnectXml in twilio.ts generates the TwiML with no token parameter in the Stream URL (just wss://voice.mydomain.com/voice/stream). Yet the runtime rejects with "invalid token", so the validation seems to happen somewhere outside the visible TypeScript source.
Is there a config flag to disable stream token validation? Or is this a known issue with external tunnels?
OpenClaw 2026.2.3-1, Windows, Node 24
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
83,815Members
Resources
Similar Threads
Was this page helpful?
