Automating inbound calls with an AI voice agent in n8n (Vapi + Twilio)

In 2026, the phone remains the channel customers reach for when everything else has failed: the chatbot didn't understand, the email went unanswered, the situation is urgent. Letting it ring out or dumping the caller on a rigid touch-tone menu is still one of the costliest friction points in customer support — and it's exactly what AI voice agents, paired with an automation engine like n8n, are starting to close meaningfully. This guide walks through the concrete architecture: a Twilio number, a Vapi voice agent for the conversation, and n8n as the business-logic brain called in real time during the call.

Why connect an AI voice agent to your n8n automations

The point isn't to replace human support, but to absorb what doesn't need it: order status, booking or rescheduling an appointment, frequent product questions, initial qualification before a handoff. A field study run inside a large telecom call center, Wang, Huang, Hong, Liu, Guo & Chen (2023), Voice-based AI in call center customer service: A natural field experiment, published in Production and Operations Management (Google Scholar), shows that introducing a voice-based AI system durably reduces customer complaints — but also that a speech-recognition failure has the opposite effect: it increases demand for a human transfer and complaints. Two lessons that translate directly into an n8n architecture: design the system to fail cleanly toward a human, and never force the agent to guess when it hasn't understood.

The three-layer architecture: Twilio, Vapi, n8n

Three building blocks, three distinct responsibilities:

• Twilio provides the phone number and carries the call over the public telephone network (PSTN).
• Vapi handles the voice layer: real-time speech recognition, turn-taking, text-to-speech synthesis, and the language-model call that decides what to say.
• n8n acts as the business brain: whenever the voice agent needs a piece of data or must trigger an action (look up an order, block a time slot, search your documentation), Vapi calls a custom tool — which is nothing more than an n8n webhook.

This separation is what keeps the whole thing maintainable: the business logic lives in n8n, exactly like your other automations, instead of being scattered across a third-party voice tool's configuration.

Setting up the number: importing Twilio into Vapi

The starting point is an existing Twilio number (or one purchased through Twilio). In the Vapi interface, the phone numbers section lets you import a Twilio number by entering the account's SID and Auth Token: Vapi then takes over handling inbound and outbound calls for that number. In the Twilio settings for the imported number, the "A call comes in" setting must point to a webhook managed by Vapi rather than to plain TwiML — that's what lets the conversational agent pick up instead of a static voice menu. A Vapi assistant (voice, system prompt, allowed tools) is then assigned to the number for inbound calls.

Wiring n8n as the voice agent's tool

This is where business logic comes in. The principle: in its system prompt, the Vapi voice agent knows it has one or more tools available (for example check_order or book_appointment) that it can call during the conversation — exactly like an n8n AI Agent node calls its own tools. On the n8n side:

1. Webhook — an n8n-nodes-base.webhook node in POST mode receives Vapi's tool calls. Test first with the development URL before switching the Vapi assistant to the production URL, as with any n8n webhook.
2. In Vapi, the assistant's Server URL points to this webhook, and in the "Server Messages" settings, only the tool-calls type should be enabled — there's no need to receive every event of the conversation.
3. Switch — an n8n-nodes-base.switch node routes based on the name of the called tool (message.toolCalls[0].function.name): one branch per possible business action.
4. Each branch runs the corresponding logic — a Supabase read, a call to your CRM, a lookup in a documentation base — then a Respond to Webhook node returns the result in the format Vapi expects, which it turns back into speech for the caller.

This webhook-plus-immediate-response pattern is the same one described in our article on webhook timeouts with an AI agent: a voice conversation tolerates waiting even less than a text chat, so the business logic being called must respond within one to two seconds at most, or acknowledge receipt and deliver the rest asynchronously if the processing takes longer.

Concrete use cases to build

Three examples cover most of the inbound calls a small business gets:

• Appointment booking: the voice tool checks available slots and books one, reusing the same logic as our AI appointment booking workflow, adapted from an email trigger to a Vapi webhook trigger.
• Product questions against a documentation base: the tool queries an existing RAG pipeline — the one described in our Supabase pgvector + n8n guide, or directly the RAG chatbot with citations workflow from the RAG Assistant Pack (€119) — to answer with the real information from your catalog instead of a generic response.
• Qualified handoff to a human: when the detected category is sensitive (complaint, cancellation) or the agent's confidence is low, the tool returns a transfer instruction instead of an answer — the same scoring principle as the Inbox AI Pack (€79) for urgent emails, applied to voice.

Logging every call and staying GDPR-compliant

A phone call handled by an AI is still sensitive personal data (voice, conversation content, sometimes health or payment information). Every tool call triggered by Vapi should be logged on the n8n side — timestamp, caller number, triggered action, result — in a dedicated Supabase table, following the same model as the GDPR audit trail described for n8n automations. It's the same audit-logging mechanism used by the Supabase audit logging workflow from the Compliance & Audit Pack (€149) — directly reusable to trace who — human or AI — did what on a customer case, phone calls included.

Securing a webhook exposed to a third-party voice service

The n8n webhook that receives Vapi's tool calls is, like any webhook, an open door into your instance from the outside. The same precautions apply: verifying a shared secret or an HMAC signature on every incoming request, and restricting the network origin where possible — the full details are in our guide to securing a publicly exposed n8n webhook. Without that check, anyone who knows the webhook URL could inject fake tool calls into your business logic.

Limits to know before going to production

• Latency stacks up: speech recognition, the LLM call, a possible round trip to n8n, then speech synthesis — each link adds a few hundred milliseconds. Keep the n8n logic called mid-conversation as light as possible; save heavy processing for an asynchronous trigger after the call ends.
• Cost is per minute: telephony, transcription/synthesis and the language model all accumulate over the call's duration. Capping the maximum call length on the Vapi side prevents a misunderstanding loop from driving up the bill.
• A recognition failure needs a fallback: as the study cited above shows, a misunderstood customer asks for a human again and complains more. Always build in a clear transfer path rather than letting the agent keep insisting.

Launch checklist

• Twilio number imported into Vapi, with the assistant assigned to inbound calls.
• n8n webhook tested in development before switching the Vapi assistant to the production URL.
• Switch routing each tool to its business branch, with a response returned in under one to two seconds.
• Every tool call systematically logged in Supabase, with the same rigor as a GDPR audit trail.
• Webhook signed or protected by a secret, never left open without verification.
• Explicit human-transfer branch for sensitive cases or repeated understanding failures.

A well-architected AI voice agent doesn't replace your support team: it saves them from picking up just to check an order status or book a slot, the same way FlowKit's pack workflows save you from sorting emails by hand. The n8n building block — webhook, routing, logging — is the same one already in place if you're using one of our packs; all that's left is wiring in the voice.