Skip to contentSkip to navigationSkip to topbar
Rate this page:
On this page

Secure Playback of Recordings from Custom Storage


You can manage user access to call recordings from Flex Insights on your own terms.

If you store call recordings outside of Twilio, you can use this feature to:

  • Create a custom authorization of users
  • Log user access to individual recordings
  • Decrypt Twilio recordings encrypted by your public key (using your private key)

You can use the url_provider attribute when attaching Custom Media. Flex Insights Player sends a request to the URL to ask for the actual link to the recording. Your service at the provided URL can then perform any authorization operations before providing the link. The link itself has to carry any authorization information, such as a time-limited token, single-use token, etc.

You can point the Player to a standard service such as AWS S3. Or, you can point the Player to a custom service that may perform additional operations before streaming the actual audio. For example, decryption of the audio.

(information)

Info

Waveform (blue, green, red, and orange bars) is not available in the Conversation Screen for recordings that are stored externally. This means users will not see when an agent or customer is speaking while playing back recordings.


Flex Insights Player Request to Your Service

flex-insights-player-request-to-your-service page anchor

When you open a recording from Flex Insights, the Player calls the API URL you provided as the value of the url_provider attribute. The Player adds the Flex JWE token in the authorization header. The token is Base64 encoded.

Example request:


_14
GET /sec_rec?recording_sid=RExxxxxxxxxxxxxxxxxxxxxxx HTTP/1.1
_14
Host: your_domain
_14
Connection: keep-alive
_14
Pragma: no-cache
_14
Cache-Control: no-cache
_14
Authorization: Basic dG9rZW46ZXlKNmFYQWlPaUpFUlVZaUxDSnJhV1FpT2lKVFFWTmZVek1==
_14
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36
_14
Accept: */*
_14
Origin: https://flex.twilio.com
_14
Sec-Fetch-Site: cross-site
_14
Sec-Fetch-Mode: cors
_14
Sec-Fetch-Dest: empty
_14
Accept-Encoding: gzip, deflate, br
_14
Accept-Language: en-US,en;q=0.9,cs;q=0.8


Handle the Request from Player in Your Service

handle-the-request-from-player-in-your-service page anchor

To enable playback, your API service has to:

  1. Validate the Flex JWE token provided by the Player in the authorization header. The validation ensures that the user has a valid Flex session.
  2. Return the 'media_url' link to the audio file of the recording. The Player uses this link to retrieve the actual recording.
(warning)

Warning

In the following example, we are using a Twilio function to validate a token. Please note that you cannot host your authentication function using Twilio Serverless due to its max header limitations.

Validate the Flex JWE Token

validate-the-flex-jwe-token page anchor

The Flex JWE token is sent in the following format:


_10
Basic ${Buffer.from(`token:${flexJWE}`).toString('base64')}

The Flex JWE token is Base64 encoded. Your service has to decode the token, then use the Twilio Flex Token Validator(link takes you to an external page) in a Twilio Function or in any NodeJS application. Alternatively you can use the Twilio API to validate the token.

Example of token validation in Python:


_13
header_raw = request.headers.get('Authorization')
_13
header_decoded = b64decode(header_raw.split()[1]).decode()
_13
token = header_decoded.split(':')[1]
_13
_13
url = "https://iam.twilio.com/v1/Accounts/{}/Tokens/validate".
_13
format(TWILIO_ACCOUNT_SID)
_13
headers = {
_13
"content-type": "application/json",
_13
"cache-control": "no-cache",
_13
"Authorization": header_raw
_13
}
_13
payload = {"token": token}
_13
response = requests.post(url, data=json.dumps(payload), headers=headers)

The validated token result contains the following data:


_12
{
_12
"valid": true,
_12
"code": 0,
_12
"message": null,
_12
"expiration": "2018-09-24T23:22:44.240Z",
_12
"realm_user_id": "user@example.com",
_12
"identity": "user_40example_2Dcom",
_12
"roles":[
_12
"agent"
_12
],
_12
"worker_sid": "WKxxx"
_12
}


While listening to a recording, open the Developer Tools > Network tab in your browser. Confirm that your browser requested both the 'url_provider' and the 'media_url'.

Secure_troubleshooting.

Rate this page: