[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-openai-twilio-security-hardening":3,"mdc--hsrm2m-key":36,"related-org-openai-twilio-security-hardening":1409,"related-repo-openai-twilio-security-hardening":1616},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"twilio-security-hardening","harden Twilio application security","Secure Twilio applications against common attacks. Covers credential management (API keys vs auth tokens), request validation (webhook signature verification), PCI DSS compliance, HIPAA account requirements, SMS pumping prevention, geo-permissions, and account isolation patterns. Use this skill when developers are building or deploying Twilio apps.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"openai","OpenAI","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fopenai.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Operations","operations",{"name":20,"slug":21,"type":15},"Compliance","compliance",{"name":23,"slug":24,"type":15},"Twilio","twilio",3992,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fplugins","2026-06-30T19:00:57.102",null,465,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],"OpenAI Plugins","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fplugins\u002Ftree\u002FHEAD\u002Fplugins\u002Ftwilio-developer-kit\u002Fskills\u002Ftwilio-security-hardening","---\nname: twilio-security-hardening\ndescription: >\n  Secure Twilio applications against common attacks. Covers credential\n  management (API keys vs auth tokens), request validation (webhook\n  signature verification), PCI DSS compliance, HIPAA account requirements,\n  SMS pumping prevention, geo-permissions, and account isolation patterns.\n  Use this skill when developers are building or deploying Twilio apps.\n---\n\n## Overview\n\nSecurity hardening is an **ongoing** concern — not a one-time setup. This skill covers account-level security decisions and application-level protection patterns that prevent credential leaks, fraud, and compliance violations.\n\n**Lifecycle:** Choose numbers (`twilio-numbers-senders`) → Register (`twilio-compliance-onboarding`) → Follow traffic rules (`twilio-compliance-traffic`) → Secure everything (this skill)\n\n---\n\n## Credential Management\n\n### API Keys vs Auth Tokens\n\n| Credential | Scope | Revocable | Use when |\n|-----------|-------|-----------|----------|\n| **Auth Token** | Full account access | Only by rotating (invalidates ALL API keys) | Never in production — use API keys instead |\n| **API Key + Secret** | Scoped, revocable individually | Yes — revoke one without affecting others | Production applications, CI\u002FCD, server-side code |\n| **Access Tokens** | Short-lived, client-specific | Expire automatically | Client-side SDKs (Voice, Video, Conversations) |\n\n**Critical gotcha:** Rotating your Auth Token **invalidates ALL existing API keys**. This is a one-way door that can break every integration simultaneously. Use API keys from the start so you never need to rotate the Auth Token.\n\n### Best Practices\n\n- Store credentials in environment variables or a secrets manager — never in code\n- Use different API keys per application\u002Fenvironment\n- Rotate API keys on a schedule (quarterly minimum, monthly for HIPAA)\n- Use sub-accounts to isolate customer credentials for ISV platforms — see `twilio-account-setup`\n\n**Docs:** See `twilio-iam-auth-setup` for full credential setup patterns.\n\n---\n\n## Request Validation (Webhook Security)\n\nVerify that webhook requests actually come from Twilio — not spoofed by attackers.\n\n### X-Twilio-Signature Validation\n\nAlways use the SDK validator — don't implement HMAC-SHA1 manually:\n\n**Node.js**\n```javascript\nconst twilio = require(\"twilio\");\n\napp.post(\"\u002Fsms\", (req, res) => {\n    const valid = twilio.validateRequest(\n        process.env.TWILIO_AUTH_TOKEN,\n        req.headers[\"x-twilio-signature\"],\n        `https:\u002F\u002Fyourdomain.com\u002Fsms`,\n        req.body\n    );\n    if (!valid) return res.status(403).send(\"Forbidden\");\n    \u002F\u002F Process webhook...\n});\n```\n\n**Common mistakes:**\n- Using HTTP URL when Twilio sends to HTTPS (URL must match exactly)\n- Forgetting to include query string parameters in validation URL\n- Not validating in production because \"it worked in dev without it\"\n\n**Docs:** See `twilio-webhook-architecture` for full webhook security patterns.\n\n---\n\n## Account-Level Compliance\n\n### PCI DSS (Payment Card Industry)\n\n**PCI Mode is IRREVERSIBLE and account-wide.** Once enabled, it cannot be disabled — ever.\n\n- All recordings are encrypted\n- Transcript access is restricted\n- Affects every service on the account\n\n**Recommendation:** If you need PCI compliance for one use case, create a **separate sub-account** dedicated to payment-related calls. See `twilio-account-setup` for sub-account patterns.\n\nFor call recording during payment, pause recording when the customer gives card numbers:\n```python\nclient.calls(call_sid).recordings(recording_sid).update(status=\"paused\")\n```\n\nOr use the `\u003CPay>` verb to handle payments without your application touching card data:\n```xml\n\u003CPay paymentConnector=\"stripe_connector\" chargeAmount=\"49.99\" currency=\"usd\" \u002F>\n```\n\n### HIPAA (Healthcare)\n\nBefore handling Protected Health Information (PHI):\n- **Execute a BAA** (Business Associate Agreement) with Twilio — contact your account manager or [submit a sales request](https:\u002F\u002Fwww.twilio.com\u002Fen-us\u002Fhelp\u002Fsales) if you don't have one\n- **Encrypt all recordings** containing PHI\n- **Minimize PHI in TTS** — don't speak full patient details via `\u003CSay>`\n- **Rotate API keys** on a regular schedule\n- **Restrict access** to recordings and transcripts\n\n---\n\n## Fraud Prevention\n\n### SMS Pumping Protection\n\nAttackers trigger thousands of OTP messages to premium-rate numbers, generating toll charges.\n\n**Layered defense:**\n1. **Twilio Verify Fraud Guard** — built-in fraud detection (enable on Verify Service)\n2. **Lookup pre-check** — call `twilio-lookup-phone-intelligence` to check line type + SMS pumping risk score before sending\n3. **Geo-permissions** — restrict SMS\u002Fvoice to countries where you have customers ([Console > Messaging > Geo Permissions](https:\u002F\u002Fconsole.twilio.com))\n4. **Rate limiting** — limit verification attempts per IP, per phone number, per time window\n\n### Geo-Permissions\n\nRestrict which countries can receive messages or calls from your account:\n- Disable all countries you don't serve (SMS and Voice separately)\n- Re-enable only as needed — [configure in Console](https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fmessaging\u002Fguides\u002Fsms-geo-permissions)\n- This is the single most effective anti-fraud measure for SMS pumping\n\n**SMS pumping impact:** Incidents can climb into tens of thousands of dollars. Twilio does not publish most-targeted prefixes — the general guidance is to restrict message termination to countries where you do business via geo-permissions. Customers using Fraud Guard can view estimated fraud savings in their [Fraud Guard reports](https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fverify\u002Fpreventing-toll-fraud\u002Fsms-fraud-guard).\n\n---\n\n## Common Mistakes\n\n1. **Auth Token in code** — Pushed to GitHub, leaked. Use environment variables + API keys.\n2. **No webhook validation** — Attackers can send fake webhook requests to your endpoints.\n3. **PCI Mode on main account** — Irreversible. Use a sub-account for payment use cases.\n4. **No geo-permissions** — Account is open to SMS pumping from any country.\n5. **Auth Token rotation without planning** — Breaks all API keys simultaneously.\n\n---\n\n## Credential Rotation (Zero-Downtime)\n\nBoth API keys and Auth Tokens follow the same workflow:\n\n1. **Create secondary** — generate a new API key (or note the new Auth Token)\n2. **Operationalize secondary** — deploy the new credential to all services\n3. **Promote secondary to primary** — verify all traffic uses the new credential\n4. **Delete old primary** — revoke the previous credential\n\nManage keys at: `https:\u002F\u002Fconsole.twilio.com\u002Faccount\u002Fkeys-credentials\u002Fapi-keys` (per account).\n\n**Key enabler: use a secrets manager** (AWS Secrets Manager, HashiCorp Vault, etc.) to inject credentials at runtime. This makes rotation near-instantaneous with no downtime — no code changes, no redeployments. Organizations that hard-code credentials into repos, deployment scripts, or `.env` files must manually update every location before deleting the old key.\n\nFor ISVs managing many sub-accounts, automate this with the API Keys REST API across accounts.\n\n---\n\n## Next Steps\n\n- **Credential setup and API key management:** `twilio-iam-auth-setup`\n- **Webhook security and signature validation:** `twilio-webhook-architecture`\n- **Account structure and sub-accounts:** `twilio-account-setup`\n- **Phone intelligence for fraud scoring:** `twilio-lookup-phone-intelligence`\n- **Traffic compliance rules:** `twilio-compliance-traffic`\n",{"data":37,"body":38},{"name":4,"description":6},{"type":39,"children":40},"root",[41,50,64,99,103,109,116,232,249,255,286,304,307,313,318,324,329,337,783,791,809,825,828,834,840,850,868,892,897,913,926,942,948,953,1023,1026,1032,1038,1043,1051,1111,1117,1122,1147,1165,1168,1174,1227,1230,1236,1241,1284,1297,1315,1320,1323,1329,1403],{"type":42,"tag":43,"props":44,"children":46},"element","h2",{"id":45},"overview",[47],{"type":48,"value":49},"text","Overview",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54,56,62],{"type":48,"value":55},"Security hardening is an ",{"type":42,"tag":57,"props":58,"children":59},"strong",{},[60],{"type":48,"value":61},"ongoing",{"type":48,"value":63}," concern — not a one-time setup. This skill covers account-level security decisions and application-level protection patterns that prevent credential leaks, fraud, and compliance violations.",{"type":42,"tag":51,"props":65,"children":66},{},[67,72,74,81,83,89,91,97],{"type":42,"tag":57,"props":68,"children":69},{},[70],{"type":48,"value":71},"Lifecycle:",{"type":48,"value":73}," Choose numbers (",{"type":42,"tag":75,"props":76,"children":78},"code",{"className":77},[],[79],{"type":48,"value":80},"twilio-numbers-senders",{"type":48,"value":82},") → Register (",{"type":42,"tag":75,"props":84,"children":86},{"className":85},[],[87],{"type":48,"value":88},"twilio-compliance-onboarding",{"type":48,"value":90},") → Follow traffic rules (",{"type":42,"tag":75,"props":92,"children":94},{"className":93},[],[95],{"type":48,"value":96},"twilio-compliance-traffic",{"type":48,"value":98},") → Secure everything (this skill)",{"type":42,"tag":100,"props":101,"children":102},"hr",{},[],{"type":42,"tag":43,"props":104,"children":106},{"id":105},"credential-management",[107],{"type":48,"value":108},"Credential Management",{"type":42,"tag":110,"props":111,"children":113},"h3",{"id":112},"api-keys-vs-auth-tokens",[114],{"type":48,"value":115},"API Keys vs Auth Tokens",{"type":42,"tag":117,"props":118,"children":119},"table",{},[120,149],{"type":42,"tag":121,"props":122,"children":123},"thead",{},[124],{"type":42,"tag":125,"props":126,"children":127},"tr",{},[128,134,139,144],{"type":42,"tag":129,"props":130,"children":131},"th",{},[132],{"type":48,"value":133},"Credential",{"type":42,"tag":129,"props":135,"children":136},{},[137],{"type":48,"value":138},"Scope",{"type":42,"tag":129,"props":140,"children":141},{},[142],{"type":48,"value":143},"Revocable",{"type":42,"tag":129,"props":145,"children":146},{},[147],{"type":48,"value":148},"Use when",{"type":42,"tag":150,"props":151,"children":152},"tbody",{},[153,180,206],{"type":42,"tag":125,"props":154,"children":155},{},[156,165,170,175],{"type":42,"tag":157,"props":158,"children":159},"td",{},[160],{"type":42,"tag":57,"props":161,"children":162},{},[163],{"type":48,"value":164},"Auth Token",{"type":42,"tag":157,"props":166,"children":167},{},[168],{"type":48,"value":169},"Full account access",{"type":42,"tag":157,"props":171,"children":172},{},[173],{"type":48,"value":174},"Only by rotating (invalidates ALL API keys)",{"type":42,"tag":157,"props":176,"children":177},{},[178],{"type":48,"value":179},"Never in production — use API keys instead",{"type":42,"tag":125,"props":181,"children":182},{},[183,191,196,201],{"type":42,"tag":157,"props":184,"children":185},{},[186],{"type":42,"tag":57,"props":187,"children":188},{},[189],{"type":48,"value":190},"API Key + Secret",{"type":42,"tag":157,"props":192,"children":193},{},[194],{"type":48,"value":195},"Scoped, revocable individually",{"type":42,"tag":157,"props":197,"children":198},{},[199],{"type":48,"value":200},"Yes — revoke one without affecting others",{"type":42,"tag":157,"props":202,"children":203},{},[204],{"type":48,"value":205},"Production applications, CI\u002FCD, server-side code",{"type":42,"tag":125,"props":207,"children":208},{},[209,217,222,227],{"type":42,"tag":157,"props":210,"children":211},{},[212],{"type":42,"tag":57,"props":213,"children":214},{},[215],{"type":48,"value":216},"Access Tokens",{"type":42,"tag":157,"props":218,"children":219},{},[220],{"type":48,"value":221},"Short-lived, client-specific",{"type":42,"tag":157,"props":223,"children":224},{},[225],{"type":48,"value":226},"Expire automatically",{"type":42,"tag":157,"props":228,"children":229},{},[230],{"type":48,"value":231},"Client-side SDKs (Voice, Video, Conversations)",{"type":42,"tag":51,"props":233,"children":234},{},[235,240,242,247],{"type":42,"tag":57,"props":236,"children":237},{},[238],{"type":48,"value":239},"Critical gotcha:",{"type":48,"value":241}," Rotating your Auth Token ",{"type":42,"tag":57,"props":243,"children":244},{},[245],{"type":48,"value":246},"invalidates ALL existing API keys",{"type":48,"value":248},". This is a one-way door that can break every integration simultaneously. Use API keys from the start so you never need to rotate the Auth Token.",{"type":42,"tag":110,"props":250,"children":252},{"id":251},"best-practices",[253],{"type":48,"value":254},"Best Practices",{"type":42,"tag":256,"props":257,"children":258},"ul",{},[259,265,270,275],{"type":42,"tag":260,"props":261,"children":262},"li",{},[263],{"type":48,"value":264},"Store credentials in environment variables or a secrets manager — never in code",{"type":42,"tag":260,"props":266,"children":267},{},[268],{"type":48,"value":269},"Use different API keys per application\u002Fenvironment",{"type":42,"tag":260,"props":271,"children":272},{},[273],{"type":48,"value":274},"Rotate API keys on a schedule (quarterly minimum, monthly for HIPAA)",{"type":42,"tag":260,"props":276,"children":277},{},[278,280],{"type":48,"value":279},"Use sub-accounts to isolate customer credentials for ISV platforms — see ",{"type":42,"tag":75,"props":281,"children":283},{"className":282},[],[284],{"type":48,"value":285},"twilio-account-setup",{"type":42,"tag":51,"props":287,"children":288},{},[289,294,296,302],{"type":42,"tag":57,"props":290,"children":291},{},[292],{"type":48,"value":293},"Docs:",{"type":48,"value":295}," See ",{"type":42,"tag":75,"props":297,"children":299},{"className":298},[],[300],{"type":48,"value":301},"twilio-iam-auth-setup",{"type":48,"value":303}," for full credential setup patterns.",{"type":42,"tag":100,"props":305,"children":306},{},[],{"type":42,"tag":43,"props":308,"children":310},{"id":309},"request-validation-webhook-security",[311],{"type":48,"value":312},"Request Validation (Webhook Security)",{"type":42,"tag":51,"props":314,"children":315},{},[316],{"type":48,"value":317},"Verify that webhook requests actually come from Twilio — not spoofed by attackers.",{"type":42,"tag":110,"props":319,"children":321},{"id":320},"x-twilio-signature-validation",[322],{"type":48,"value":323},"X-Twilio-Signature Validation",{"type":42,"tag":51,"props":325,"children":326},{},[327],{"type":48,"value":328},"Always use the SDK validator — don't implement HMAC-SHA1 manually:",{"type":42,"tag":51,"props":330,"children":331},{},[332],{"type":42,"tag":57,"props":333,"children":334},{},[335],{"type":48,"value":336},"Node.js",{"type":42,"tag":338,"props":339,"children":344},"pre",{"className":340,"code":341,"language":342,"meta":343,"style":343},"language-javascript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","const twilio = require(\"twilio\");\n\napp.post(\"\u002Fsms\", (req, res) => {\n    const valid = twilio.validateRequest(\n        process.env.TWILIO_AUTH_TOKEN,\n        req.headers[\"x-twilio-signature\"],\n        `https:\u002F\u002Fyourdomain.com\u002Fsms`,\n        req.body\n    );\n    if (!valid) return res.status(403).send(\"Forbidden\");\n    \u002F\u002F Process webhook...\n});\n","javascript","",[345],{"type":42,"tag":75,"props":346,"children":347},{"__ignoreMap":343},[348,407,417,492,531,563,608,631,648,661,756,766],{"type":42,"tag":349,"props":350,"children":353},"span",{"class":351,"line":352},"line",1,[354,360,366,372,378,383,388,393,397,402],{"type":42,"tag":349,"props":355,"children":357},{"style":356},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[358],{"type":48,"value":359},"const",{"type":42,"tag":349,"props":361,"children":363},{"style":362},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[364],{"type":48,"value":365}," twilio ",{"type":42,"tag":349,"props":367,"children":369},{"style":368},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[370],{"type":48,"value":371},"=",{"type":42,"tag":349,"props":373,"children":375},{"style":374},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[376],{"type":48,"value":377}," require",{"type":42,"tag":349,"props":379,"children":380},{"style":362},[381],{"type":48,"value":382},"(",{"type":42,"tag":349,"props":384,"children":385},{"style":368},[386],{"type":48,"value":387},"\"",{"type":42,"tag":349,"props":389,"children":391},{"style":390},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[392],{"type":48,"value":24},{"type":42,"tag":349,"props":394,"children":395},{"style":368},[396],{"type":48,"value":387},{"type":42,"tag":349,"props":398,"children":399},{"style":362},[400],{"type":48,"value":401},")",{"type":42,"tag":349,"props":403,"children":404},{"style":368},[405],{"type":48,"value":406},";\n",{"type":42,"tag":349,"props":408,"children":410},{"class":351,"line":409},2,[411],{"type":42,"tag":349,"props":412,"children":414},{"emptyLinePlaceholder":413},true,[415],{"type":48,"value":416},"\n",{"type":42,"tag":349,"props":418,"children":420},{"class":351,"line":419},3,[421,426,431,436,440,444,449,453,458,463,469,473,478,482,487],{"type":42,"tag":349,"props":422,"children":423},{"style":362},[424],{"type":48,"value":425},"app",{"type":42,"tag":349,"props":427,"children":428},{"style":368},[429],{"type":48,"value":430},".",{"type":42,"tag":349,"props":432,"children":433},{"style":374},[434],{"type":48,"value":435},"post",{"type":42,"tag":349,"props":437,"children":438},{"style":362},[439],{"type":48,"value":382},{"type":42,"tag":349,"props":441,"children":442},{"style":368},[443],{"type":48,"value":387},{"type":42,"tag":349,"props":445,"children":446},{"style":390},[447],{"type":48,"value":448},"\u002Fsms",{"type":42,"tag":349,"props":450,"children":451},{"style":368},[452],{"type":48,"value":387},{"type":42,"tag":349,"props":454,"children":455},{"style":368},[456],{"type":48,"value":457},",",{"type":42,"tag":349,"props":459,"children":460},{"style":368},[461],{"type":48,"value":462}," (",{"type":42,"tag":349,"props":464,"children":466},{"style":465},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic",[467],{"type":48,"value":468},"req",{"type":42,"tag":349,"props":470,"children":471},{"style":368},[472],{"type":48,"value":457},{"type":42,"tag":349,"props":474,"children":475},{"style":465},[476],{"type":48,"value":477}," res",{"type":42,"tag":349,"props":479,"children":480},{"style":368},[481],{"type":48,"value":401},{"type":42,"tag":349,"props":483,"children":484},{"style":356},[485],{"type":48,"value":486}," =>",{"type":42,"tag":349,"props":488,"children":489},{"style":368},[490],{"type":48,"value":491}," {\n",{"type":42,"tag":349,"props":493,"children":495},{"class":351,"line":494},4,[496,501,506,511,516,520,525],{"type":42,"tag":349,"props":497,"children":498},{"style":356},[499],{"type":48,"value":500},"    const",{"type":42,"tag":349,"props":502,"children":503},{"style":362},[504],{"type":48,"value":505}," valid",{"type":42,"tag":349,"props":507,"children":508},{"style":368},[509],{"type":48,"value":510}," =",{"type":42,"tag":349,"props":512,"children":513},{"style":362},[514],{"type":48,"value":515}," twilio",{"type":42,"tag":349,"props":517,"children":518},{"style":368},[519],{"type":48,"value":430},{"type":42,"tag":349,"props":521,"children":522},{"style":374},[523],{"type":48,"value":524},"validateRequest",{"type":42,"tag":349,"props":526,"children":528},{"style":527},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[529],{"type":48,"value":530},"(\n",{"type":42,"tag":349,"props":532,"children":534},{"class":351,"line":533},5,[535,540,544,549,553,558],{"type":42,"tag":349,"props":536,"children":537},{"style":362},[538],{"type":48,"value":539},"        process",{"type":42,"tag":349,"props":541,"children":542},{"style":368},[543],{"type":48,"value":430},{"type":42,"tag":349,"props":545,"children":546},{"style":362},[547],{"type":48,"value":548},"env",{"type":42,"tag":349,"props":550,"children":551},{"style":368},[552],{"type":48,"value":430},{"type":42,"tag":349,"props":554,"children":555},{"style":362},[556],{"type":48,"value":557},"TWILIO_AUTH_TOKEN",{"type":42,"tag":349,"props":559,"children":560},{"style":368},[561],{"type":48,"value":562},",\n",{"type":42,"tag":349,"props":564,"children":566},{"class":351,"line":565},6,[567,572,576,581,586,590,595,599,604],{"type":42,"tag":349,"props":568,"children":569},{"style":362},[570],{"type":48,"value":571},"        req",{"type":42,"tag":349,"props":573,"children":574},{"style":368},[575],{"type":48,"value":430},{"type":42,"tag":349,"props":577,"children":578},{"style":362},[579],{"type":48,"value":580},"headers",{"type":42,"tag":349,"props":582,"children":583},{"style":527},[584],{"type":48,"value":585},"[",{"type":42,"tag":349,"props":587,"children":588},{"style":368},[589],{"type":48,"value":387},{"type":42,"tag":349,"props":591,"children":592},{"style":390},[593],{"type":48,"value":594},"x-twilio-signature",{"type":42,"tag":349,"props":596,"children":597},{"style":368},[598],{"type":48,"value":387},{"type":42,"tag":349,"props":600,"children":601},{"style":527},[602],{"type":48,"value":603},"]",{"type":42,"tag":349,"props":605,"children":606},{"style":368},[607],{"type":48,"value":562},{"type":42,"tag":349,"props":609,"children":611},{"class":351,"line":610},7,[612,617,622,627],{"type":42,"tag":349,"props":613,"children":614},{"style":368},[615],{"type":48,"value":616},"        `",{"type":42,"tag":349,"props":618,"children":619},{"style":390},[620],{"type":48,"value":621},"https:\u002F\u002Fyourdomain.com\u002Fsms",{"type":42,"tag":349,"props":623,"children":624},{"style":368},[625],{"type":48,"value":626},"`",{"type":42,"tag":349,"props":628,"children":629},{"style":368},[630],{"type":48,"value":562},{"type":42,"tag":349,"props":632,"children":634},{"class":351,"line":633},8,[635,639,643],{"type":42,"tag":349,"props":636,"children":637},{"style":362},[638],{"type":48,"value":571},{"type":42,"tag":349,"props":640,"children":641},{"style":368},[642],{"type":48,"value":430},{"type":42,"tag":349,"props":644,"children":645},{"style":362},[646],{"type":48,"value":647},"body\n",{"type":42,"tag":349,"props":649,"children":651},{"class":351,"line":650},9,[652,657],{"type":42,"tag":349,"props":653,"children":654},{"style":527},[655],{"type":48,"value":656},"    )",{"type":42,"tag":349,"props":658,"children":659},{"style":368},[660],{"type":48,"value":406},{"type":42,"tag":349,"props":662,"children":664},{"class":351,"line":663},10,[665,671,675,680,685,690,695,699,703,708,712,718,722,726,731,735,739,744,748,752],{"type":42,"tag":349,"props":666,"children":668},{"style":667},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[669],{"type":48,"value":670},"    if",{"type":42,"tag":349,"props":672,"children":673},{"style":527},[674],{"type":48,"value":462},{"type":42,"tag":349,"props":676,"children":677},{"style":368},[678],{"type":48,"value":679},"!",{"type":42,"tag":349,"props":681,"children":682},{"style":362},[683],{"type":48,"value":684},"valid",{"type":42,"tag":349,"props":686,"children":687},{"style":527},[688],{"type":48,"value":689},") ",{"type":42,"tag":349,"props":691,"children":692},{"style":667},[693],{"type":48,"value":694},"return",{"type":42,"tag":349,"props":696,"children":697},{"style":362},[698],{"type":48,"value":477},{"type":42,"tag":349,"props":700,"children":701},{"style":368},[702],{"type":48,"value":430},{"type":42,"tag":349,"props":704,"children":705},{"style":374},[706],{"type":48,"value":707},"status",{"type":42,"tag":349,"props":709,"children":710},{"style":527},[711],{"type":48,"value":382},{"type":42,"tag":349,"props":713,"children":715},{"style":714},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[716],{"type":48,"value":717},"403",{"type":42,"tag":349,"props":719,"children":720},{"style":527},[721],{"type":48,"value":401},{"type":42,"tag":349,"props":723,"children":724},{"style":368},[725],{"type":48,"value":430},{"type":42,"tag":349,"props":727,"children":728},{"style":374},[729],{"type":48,"value":730},"send",{"type":42,"tag":349,"props":732,"children":733},{"style":527},[734],{"type":48,"value":382},{"type":42,"tag":349,"props":736,"children":737},{"style":368},[738],{"type":48,"value":387},{"type":42,"tag":349,"props":740,"children":741},{"style":390},[742],{"type":48,"value":743},"Forbidden",{"type":42,"tag":349,"props":745,"children":746},{"style":368},[747],{"type":48,"value":387},{"type":42,"tag":349,"props":749,"children":750},{"style":527},[751],{"type":48,"value":401},{"type":42,"tag":349,"props":753,"children":754},{"style":368},[755],{"type":48,"value":406},{"type":42,"tag":349,"props":757,"children":759},{"class":351,"line":758},11,[760],{"type":42,"tag":349,"props":761,"children":763},{"style":762},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[764],{"type":48,"value":765},"    \u002F\u002F Process webhook...\n",{"type":42,"tag":349,"props":767,"children":769},{"class":351,"line":768},12,[770,775,779],{"type":42,"tag":349,"props":771,"children":772},{"style":368},[773],{"type":48,"value":774},"}",{"type":42,"tag":349,"props":776,"children":777},{"style":362},[778],{"type":48,"value":401},{"type":42,"tag":349,"props":780,"children":781},{"style":368},[782],{"type":48,"value":406},{"type":42,"tag":51,"props":784,"children":785},{},[786],{"type":42,"tag":57,"props":787,"children":788},{},[789],{"type":48,"value":790},"Common mistakes:",{"type":42,"tag":256,"props":792,"children":793},{},[794,799,804],{"type":42,"tag":260,"props":795,"children":796},{},[797],{"type":48,"value":798},"Using HTTP URL when Twilio sends to HTTPS (URL must match exactly)",{"type":42,"tag":260,"props":800,"children":801},{},[802],{"type":48,"value":803},"Forgetting to include query string parameters in validation URL",{"type":42,"tag":260,"props":805,"children":806},{},[807],{"type":48,"value":808},"Not validating in production because \"it worked in dev without it\"",{"type":42,"tag":51,"props":810,"children":811},{},[812,816,817,823],{"type":42,"tag":57,"props":813,"children":814},{},[815],{"type":48,"value":293},{"type":48,"value":295},{"type":42,"tag":75,"props":818,"children":820},{"className":819},[],[821],{"type":48,"value":822},"twilio-webhook-architecture",{"type":48,"value":824}," for full webhook security patterns.",{"type":42,"tag":100,"props":826,"children":827},{},[],{"type":42,"tag":43,"props":829,"children":831},{"id":830},"account-level-compliance",[832],{"type":48,"value":833},"Account-Level Compliance",{"type":42,"tag":110,"props":835,"children":837},{"id":836},"pci-dss-payment-card-industry",[838],{"type":48,"value":839},"PCI DSS (Payment Card Industry)",{"type":42,"tag":51,"props":841,"children":842},{},[843,848],{"type":42,"tag":57,"props":844,"children":845},{},[846],{"type":48,"value":847},"PCI Mode is IRREVERSIBLE and account-wide.",{"type":48,"value":849}," Once enabled, it cannot be disabled — ever.",{"type":42,"tag":256,"props":851,"children":852},{},[853,858,863],{"type":42,"tag":260,"props":854,"children":855},{},[856],{"type":48,"value":857},"All recordings are encrypted",{"type":42,"tag":260,"props":859,"children":860},{},[861],{"type":48,"value":862},"Transcript access is restricted",{"type":42,"tag":260,"props":864,"children":865},{},[866],{"type":48,"value":867},"Affects every service on the account",{"type":42,"tag":51,"props":869,"children":870},{},[871,876,878,883,885,890],{"type":42,"tag":57,"props":872,"children":873},{},[874],{"type":48,"value":875},"Recommendation:",{"type":48,"value":877}," If you need PCI compliance for one use case, create a ",{"type":42,"tag":57,"props":879,"children":880},{},[881],{"type":48,"value":882},"separate sub-account",{"type":48,"value":884}," dedicated to payment-related calls. See ",{"type":42,"tag":75,"props":886,"children":888},{"className":887},[],[889],{"type":48,"value":285},{"type":48,"value":891}," for sub-account patterns.",{"type":42,"tag":51,"props":893,"children":894},{},[895],{"type":48,"value":896},"For call recording during payment, pause recording when the customer gives card numbers:",{"type":42,"tag":338,"props":898,"children":902},{"className":899,"code":900,"language":901,"meta":343,"style":343},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","client.calls(call_sid).recordings(recording_sid).update(status=\"paused\")\n","python",[903],{"type":42,"tag":75,"props":904,"children":905},{"__ignoreMap":343},[906],{"type":42,"tag":349,"props":907,"children":908},{"class":351,"line":352},[909],{"type":42,"tag":349,"props":910,"children":911},{},[912],{"type":48,"value":900},{"type":42,"tag":51,"props":914,"children":915},{},[916,918,924],{"type":48,"value":917},"Or use the ",{"type":42,"tag":75,"props":919,"children":921},{"className":920},[],[922],{"type":48,"value":923},"\u003CPay>",{"type":48,"value":925}," verb to handle payments without your application touching card data:",{"type":42,"tag":338,"props":927,"children":931},{"className":928,"code":929,"language":930,"meta":343,"style":343},"language-xml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u003CPay paymentConnector=\"stripe_connector\" chargeAmount=\"49.99\" currency=\"usd\" \u002F>\n","xml",[932],{"type":42,"tag":75,"props":933,"children":934},{"__ignoreMap":343},[935],{"type":42,"tag":349,"props":936,"children":937},{"class":351,"line":352},[938],{"type":42,"tag":349,"props":939,"children":940},{},[941],{"type":48,"value":929},{"type":42,"tag":110,"props":943,"children":945},{"id":944},"hipaa-healthcare",[946],{"type":48,"value":947},"HIPAA (Healthcare)",{"type":42,"tag":51,"props":949,"children":950},{},[951],{"type":48,"value":952},"Before handling Protected Health Information (PHI):",{"type":42,"tag":256,"props":954,"children":955},{},[956,977,987,1003,1013],{"type":42,"tag":260,"props":957,"children":958},{},[959,964,966,975],{"type":42,"tag":57,"props":960,"children":961},{},[962],{"type":48,"value":963},"Execute a BAA",{"type":48,"value":965}," (Business Associate Agreement) with Twilio — contact your account manager or ",{"type":42,"tag":967,"props":968,"children":972},"a",{"href":969,"rel":970},"https:\u002F\u002Fwww.twilio.com\u002Fen-us\u002Fhelp\u002Fsales",[971],"nofollow",[973],{"type":48,"value":974},"submit a sales request",{"type":48,"value":976}," if you don't have one",{"type":42,"tag":260,"props":978,"children":979},{},[980,985],{"type":42,"tag":57,"props":981,"children":982},{},[983],{"type":48,"value":984},"Encrypt all recordings",{"type":48,"value":986}," containing PHI",{"type":42,"tag":260,"props":988,"children":989},{},[990,995,997],{"type":42,"tag":57,"props":991,"children":992},{},[993],{"type":48,"value":994},"Minimize PHI in TTS",{"type":48,"value":996}," — don't speak full patient details via ",{"type":42,"tag":75,"props":998,"children":1000},{"className":999},[],[1001],{"type":48,"value":1002},"\u003CSay>",{"type":42,"tag":260,"props":1004,"children":1005},{},[1006,1011],{"type":42,"tag":57,"props":1007,"children":1008},{},[1009],{"type":48,"value":1010},"Rotate API keys",{"type":48,"value":1012}," on a regular schedule",{"type":42,"tag":260,"props":1014,"children":1015},{},[1016,1021],{"type":42,"tag":57,"props":1017,"children":1018},{},[1019],{"type":48,"value":1020},"Restrict access",{"type":48,"value":1022}," to recordings and transcripts",{"type":42,"tag":100,"props":1024,"children":1025},{},[],{"type":42,"tag":43,"props":1027,"children":1029},{"id":1028},"fraud-prevention",[1030],{"type":48,"value":1031},"Fraud Prevention",{"type":42,"tag":110,"props":1033,"children":1035},{"id":1034},"sms-pumping-protection",[1036],{"type":48,"value":1037},"SMS Pumping Protection",{"type":42,"tag":51,"props":1039,"children":1040},{},[1041],{"type":48,"value":1042},"Attackers trigger thousands of OTP messages to premium-rate numbers, generating toll charges.",{"type":42,"tag":51,"props":1044,"children":1045},{},[1046],{"type":42,"tag":57,"props":1047,"children":1048},{},[1049],{"type":48,"value":1050},"Layered defense:",{"type":42,"tag":1052,"props":1053,"children":1054},"ol",{},[1055,1065,1083,1101],{"type":42,"tag":260,"props":1056,"children":1057},{},[1058,1063],{"type":42,"tag":57,"props":1059,"children":1060},{},[1061],{"type":48,"value":1062},"Twilio Verify Fraud Guard",{"type":48,"value":1064}," — built-in fraud detection (enable on Verify Service)",{"type":42,"tag":260,"props":1066,"children":1067},{},[1068,1073,1075,1081],{"type":42,"tag":57,"props":1069,"children":1070},{},[1071],{"type":48,"value":1072},"Lookup pre-check",{"type":48,"value":1074}," — call ",{"type":42,"tag":75,"props":1076,"children":1078},{"className":1077},[],[1079],{"type":48,"value":1080},"twilio-lookup-phone-intelligence",{"type":48,"value":1082}," to check line type + SMS pumping risk score before sending",{"type":42,"tag":260,"props":1084,"children":1085},{},[1086,1091,1093,1100],{"type":42,"tag":57,"props":1087,"children":1088},{},[1089],{"type":48,"value":1090},"Geo-permissions",{"type":48,"value":1092}," — restrict SMS\u002Fvoice to countries where you have customers (",{"type":42,"tag":967,"props":1094,"children":1097},{"href":1095,"rel":1096},"https:\u002F\u002Fconsole.twilio.com",[971],[1098],{"type":48,"value":1099},"Console > Messaging > Geo Permissions",{"type":48,"value":401},{"type":42,"tag":260,"props":1102,"children":1103},{},[1104,1109],{"type":42,"tag":57,"props":1105,"children":1106},{},[1107],{"type":48,"value":1108},"Rate limiting",{"type":48,"value":1110}," — limit verification attempts per IP, per phone number, per time window",{"type":42,"tag":110,"props":1112,"children":1114},{"id":1113},"geo-permissions",[1115],{"type":48,"value":1116},"Geo-Permissions",{"type":42,"tag":51,"props":1118,"children":1119},{},[1120],{"type":48,"value":1121},"Restrict which countries can receive messages or calls from your account:",{"type":42,"tag":256,"props":1123,"children":1124},{},[1125,1130,1142],{"type":42,"tag":260,"props":1126,"children":1127},{},[1128],{"type":48,"value":1129},"Disable all countries you don't serve (SMS and Voice separately)",{"type":42,"tag":260,"props":1131,"children":1132},{},[1133,1135],{"type":48,"value":1134},"Re-enable only as needed — ",{"type":42,"tag":967,"props":1136,"children":1139},{"href":1137,"rel":1138},"https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fmessaging\u002Fguides\u002Fsms-geo-permissions",[971],[1140],{"type":48,"value":1141},"configure in Console",{"type":42,"tag":260,"props":1143,"children":1144},{},[1145],{"type":48,"value":1146},"This is the single most effective anti-fraud measure for SMS pumping",{"type":42,"tag":51,"props":1148,"children":1149},{},[1150,1155,1157,1164],{"type":42,"tag":57,"props":1151,"children":1152},{},[1153],{"type":48,"value":1154},"SMS pumping impact:",{"type":48,"value":1156}," Incidents can climb into tens of thousands of dollars. Twilio does not publish most-targeted prefixes — the general guidance is to restrict message termination to countries where you do business via geo-permissions. Customers using Fraud Guard can view estimated fraud savings in their ",{"type":42,"tag":967,"props":1158,"children":1161},{"href":1159,"rel":1160},"https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fverify\u002Fpreventing-toll-fraud\u002Fsms-fraud-guard",[971],[1162],{"type":48,"value":1163},"Fraud Guard reports",{"type":48,"value":430},{"type":42,"tag":100,"props":1166,"children":1167},{},[],{"type":42,"tag":43,"props":1169,"children":1171},{"id":1170},"common-mistakes",[1172],{"type":48,"value":1173},"Common Mistakes",{"type":42,"tag":1052,"props":1175,"children":1176},{},[1177,1187,1197,1207,1217],{"type":42,"tag":260,"props":1178,"children":1179},{},[1180,1185],{"type":42,"tag":57,"props":1181,"children":1182},{},[1183],{"type":48,"value":1184},"Auth Token in code",{"type":48,"value":1186}," — Pushed to GitHub, leaked. Use environment variables + API keys.",{"type":42,"tag":260,"props":1188,"children":1189},{},[1190,1195],{"type":42,"tag":57,"props":1191,"children":1192},{},[1193],{"type":48,"value":1194},"No webhook validation",{"type":48,"value":1196}," — Attackers can send fake webhook requests to your endpoints.",{"type":42,"tag":260,"props":1198,"children":1199},{},[1200,1205],{"type":42,"tag":57,"props":1201,"children":1202},{},[1203],{"type":48,"value":1204},"PCI Mode on main account",{"type":48,"value":1206}," — Irreversible. Use a sub-account for payment use cases.",{"type":42,"tag":260,"props":1208,"children":1209},{},[1210,1215],{"type":42,"tag":57,"props":1211,"children":1212},{},[1213],{"type":48,"value":1214},"No geo-permissions",{"type":48,"value":1216}," — Account is open to SMS pumping from any country.",{"type":42,"tag":260,"props":1218,"children":1219},{},[1220,1225],{"type":42,"tag":57,"props":1221,"children":1222},{},[1223],{"type":48,"value":1224},"Auth Token rotation without planning",{"type":48,"value":1226}," — Breaks all API keys simultaneously.",{"type":42,"tag":100,"props":1228,"children":1229},{},[],{"type":42,"tag":43,"props":1231,"children":1233},{"id":1232},"credential-rotation-zero-downtime",[1234],{"type":48,"value":1235},"Credential Rotation (Zero-Downtime)",{"type":42,"tag":51,"props":1237,"children":1238},{},[1239],{"type":48,"value":1240},"Both API keys and Auth Tokens follow the same workflow:",{"type":42,"tag":1052,"props":1242,"children":1243},{},[1244,1254,1264,1274],{"type":42,"tag":260,"props":1245,"children":1246},{},[1247,1252],{"type":42,"tag":57,"props":1248,"children":1249},{},[1250],{"type":48,"value":1251},"Create secondary",{"type":48,"value":1253}," — generate a new API key (or note the new Auth Token)",{"type":42,"tag":260,"props":1255,"children":1256},{},[1257,1262],{"type":42,"tag":57,"props":1258,"children":1259},{},[1260],{"type":48,"value":1261},"Operationalize secondary",{"type":48,"value":1263}," — deploy the new credential to all services",{"type":42,"tag":260,"props":1265,"children":1266},{},[1267,1272],{"type":42,"tag":57,"props":1268,"children":1269},{},[1270],{"type":48,"value":1271},"Promote secondary to primary",{"type":48,"value":1273}," — verify all traffic uses the new credential",{"type":42,"tag":260,"props":1275,"children":1276},{},[1277,1282],{"type":42,"tag":57,"props":1278,"children":1279},{},[1280],{"type":48,"value":1281},"Delete old primary",{"type":48,"value":1283}," — revoke the previous credential",{"type":42,"tag":51,"props":1285,"children":1286},{},[1287,1289,1295],{"type":48,"value":1288},"Manage keys at: ",{"type":42,"tag":75,"props":1290,"children":1292},{"className":1291},[],[1293],{"type":48,"value":1294},"https:\u002F\u002Fconsole.twilio.com\u002Faccount\u002Fkeys-credentials\u002Fapi-keys",{"type":48,"value":1296}," (per account).",{"type":42,"tag":51,"props":1298,"children":1299},{},[1300,1305,1307,1313],{"type":42,"tag":57,"props":1301,"children":1302},{},[1303],{"type":48,"value":1304},"Key enabler: use a secrets manager",{"type":48,"value":1306}," (AWS Secrets Manager, HashiCorp Vault, etc.) to inject credentials at runtime. This makes rotation near-instantaneous with no downtime — no code changes, no redeployments. Organizations that hard-code credentials into repos, deployment scripts, or ",{"type":42,"tag":75,"props":1308,"children":1310},{"className":1309},[],[1311],{"type":48,"value":1312},".env",{"type":48,"value":1314}," files must manually update every location before deleting the old key.",{"type":42,"tag":51,"props":1316,"children":1317},{},[1318],{"type":48,"value":1319},"For ISVs managing many sub-accounts, automate this with the API Keys REST API across accounts.",{"type":42,"tag":100,"props":1321,"children":1322},{},[],{"type":42,"tag":43,"props":1324,"children":1326},{"id":1325},"next-steps",[1327],{"type":48,"value":1328},"Next Steps",{"type":42,"tag":256,"props":1330,"children":1331},{},[1332,1347,1361,1375,1389],{"type":42,"tag":260,"props":1333,"children":1334},{},[1335,1340,1342],{"type":42,"tag":57,"props":1336,"children":1337},{},[1338],{"type":48,"value":1339},"Credential setup and API key management:",{"type":48,"value":1341}," ",{"type":42,"tag":75,"props":1343,"children":1345},{"className":1344},[],[1346],{"type":48,"value":301},{"type":42,"tag":260,"props":1348,"children":1349},{},[1350,1355,1356],{"type":42,"tag":57,"props":1351,"children":1352},{},[1353],{"type":48,"value":1354},"Webhook security and signature validation:",{"type":48,"value":1341},{"type":42,"tag":75,"props":1357,"children":1359},{"className":1358},[],[1360],{"type":48,"value":822},{"type":42,"tag":260,"props":1362,"children":1363},{},[1364,1369,1370],{"type":42,"tag":57,"props":1365,"children":1366},{},[1367],{"type":48,"value":1368},"Account structure and sub-accounts:",{"type":48,"value":1341},{"type":42,"tag":75,"props":1371,"children":1373},{"className":1372},[],[1374],{"type":48,"value":285},{"type":42,"tag":260,"props":1376,"children":1377},{},[1378,1383,1384],{"type":42,"tag":57,"props":1379,"children":1380},{},[1381],{"type":48,"value":1382},"Phone intelligence for fraud scoring:",{"type":48,"value":1341},{"type":42,"tag":75,"props":1385,"children":1387},{"className":1386},[],[1388],{"type":48,"value":1080},{"type":42,"tag":260,"props":1390,"children":1391},{},[1392,1397,1398],{"type":42,"tag":57,"props":1393,"children":1394},{},[1395],{"type":48,"value":1396},"Traffic compliance rules:",{"type":48,"value":1341},{"type":42,"tag":75,"props":1399,"children":1401},{"className":1400},[],[1402],{"type":48,"value":96},{"type":42,"tag":1404,"props":1405,"children":1406},"style",{},[1407],{"type":48,"value":1408},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1410,"total":1615},[1411,1432,1455,1472,1488,1507,1526,1542,1558,1572,1584,1599],{"slug":1412,"name":1412,"fn":1413,"description":1414,"org":1415,"tags":1416,"stars":1429,"repoUrl":1430,"updatedAt":1431},"prior-auth-packet-builder","build healthcare prior authorization packets","Build a concise prior authorization packet from local case files and payer policy docs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1417,1420,1423,1426],{"name":1418,"slug":1419,"type":15},"Documents","documents",{"name":1421,"slug":1422,"type":15},"Healthcare","healthcare",{"name":1424,"slug":1425,"type":15},"Insurance","insurance",{"name":1427,"slug":1428,"type":15},"Regulatory Compliance","regulatory-compliance",28169,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fopenai-agents-python","2026-04-16T05:11:39.180399",{"slug":1433,"name":1433,"fn":1434,"description":1435,"org":1436,"tags":1437,"stars":1452,"repoUrl":1453,"updatedAt":1454},"aspnet-core","build ASP.NET Core web applications","Build, review, refactor, or architect ASP.NET Core web applications using current official guidance for .NET web development. Use when working on Blazor Web Apps, Razor Pages, MVC, Minimal APIs, controller-based Web APIs, SignalR, gRPC, middleware, dependency injection, configuration, authentication, authorization, testing, performance, deployment, or ASP.NET Core upgrades.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1438,1441,1443,1446,1449],{"name":1439,"slug":1440,"type":15},".NET","dotnet",{"name":1442,"slug":1433,"type":15},"ASP.NET Core",{"name":1444,"slug":1445,"type":15},"Blazor","blazor",{"name":1447,"slug":1448,"type":15},"C#","csharp",{"name":1450,"slug":1451,"type":15},"Web Development","web-development",23787,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fskills","2026-04-12T05:07:02.819491",{"slug":1456,"name":1456,"fn":1457,"description":1458,"org":1459,"tags":1460,"stars":1452,"repoUrl":1453,"updatedAt":1471},"chatgpt-apps","build ChatGPT Apps SDK applications","Build, scaffold, refactor, and troubleshoot ChatGPT Apps SDK applications that combine an MCP server and widget UI. Use when Codex needs to design tools, register UI resources, wire the MCP Apps bridge or ChatGPT compatibility APIs, apply Apps SDK metadata or CSP or domain settings, or produce a docs-aligned project scaffold. Prefer a docs-first workflow by invoking the openai-docs skill or OpenAI developer docs MCP tools before generating code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1461,1464,1467,1470],{"name":1462,"slug":1463,"type":15},"Apps SDK","apps-sdk",{"name":1465,"slug":1466,"type":15},"ChatGPT","chatgpt",{"name":1468,"slug":1469,"type":15},"MCP","mcp",{"name":9,"slug":8,"type":15},"2026-04-12T05:07:05.468097",{"slug":1473,"name":1473,"fn":1474,"description":1475,"org":1476,"tags":1477,"stars":1452,"repoUrl":1453,"updatedAt":1487},"cli-creator","build CLIs from API docs","Build a composable CLI for Codex from API docs, an OpenAPI spec, existing curl examples, an SDK, a web app, an admin tool, or a local script. Use when the user wants Codex to create a command-line tool that can run from any repo, expose composable read\u002Fwrite commands, return stable JSON, manage auth, and pair with a companion skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1478,1481,1484],{"name":1479,"slug":1480,"type":15},"API Development","api-development",{"name":1482,"slug":1483,"type":15},"CLI","cli",{"name":1485,"slug":1486,"type":15},"Codex","codex","2026-04-12T05:07:04.132762",{"slug":1489,"name":1489,"fn":1490,"description":1491,"org":1492,"tags":1493,"stars":1452,"repoUrl":1453,"updatedAt":1506},"cloudflare-deploy","deploy projects to Cloudflare","Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1494,1497,1500,1503],{"name":1495,"slug":1496,"type":15},"Cloudflare","cloudflare",{"name":1498,"slug":1499,"type":15},"Cloudflare Pages","cloudflare-pages",{"name":1501,"slug":1502,"type":15},"Cloudflare Workers","cloudflare-workers",{"name":1504,"slug":1505,"type":15},"Deployment","deployment","2026-04-12T05:07:14.275118",{"slug":1508,"name":1508,"fn":1509,"description":1510,"org":1511,"tags":1512,"stars":1452,"repoUrl":1453,"updatedAt":1525},"define-goal","define and set measurable project goals","Help the user define a concrete, measurable goal before starting work, especially when they ask to use the goal tool, create a goal, set an objective, clarify success criteria, or turn a fuzzy intention into a quantitative outcome. Use this skill for goal creation and goal refinement only; it does not manage durable snapshots, decision logs, or long-running execution artifacts.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1513,1516,1519,1522],{"name":1514,"slug":1515,"type":15},"Productivity","productivity",{"name":1517,"slug":1518,"type":15},"Project Management","project-management",{"name":1520,"slug":1521,"type":15},"Strategy","strategy",{"name":1523,"slug":1524,"type":15},"Task Management","task-management","2026-05-23T06:17:16.870838",{"slug":1527,"name":1527,"fn":1528,"description":1529,"org":1530,"tags":1531,"stars":1452,"repoUrl":1453,"updatedAt":1541},"figma","translate Figma designs into code","Use the Figma MCP server to fetch design context, screenshots, variables, and assets from Figma, and to translate Figma nodes into production code. Trigger when a task involves Figma URLs, node IDs, design-to-code implementation, or Figma MCP setup and troubleshooting.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1532,1535,1537,1540],{"name":1533,"slug":1534,"type":15},"Design","design",{"name":1536,"slug":1527,"type":15},"Figma",{"name":1538,"slug":1539,"type":15},"Frontend","frontend",{"name":1468,"slug":1469,"type":15},"2026-04-12T05:06:47.939943",{"slug":1543,"name":1543,"fn":1544,"description":1545,"org":1546,"tags":1547,"stars":1452,"repoUrl":1453,"updatedAt":1557},"figma-code-connect-components","connect Figma designs to code components","Connects Figma design components to code components using Code Connect mapping tools. Use when user says \"code connect\", \"connect this component to code\", \"map this component\", \"link component to code\", \"create code connect mapping\", or wants to establish mappings between Figma designs and code implementations. For canvas writes via `use_figma`, use `figma-use`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1548,1549,1552,1553,1554],{"name":1533,"slug":1534,"type":15},{"name":1550,"slug":1551,"type":15},"Design System","design-system",{"name":1536,"slug":1527,"type":15},{"name":1538,"slug":1539,"type":15},{"name":1555,"slug":1556,"type":15},"UI Components","ui-components","2026-05-10T05:59:52.971881",{"slug":1559,"name":1559,"fn":1560,"description":1561,"org":1562,"tags":1563,"stars":1452,"repoUrl":1453,"updatedAt":1571},"figma-create-design-system-rules","generate design system rules from Figma","Generates custom design system rules for the user's codebase. Use when user says \"create design system rules\", \"generate rules for my project\", \"set up design rules\", \"customize design system guidelines\", or wants to establish project-specific conventions for Figma-to-code workflows. Requires Figma MCP server connection.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1564,1565,1566,1569,1570],{"name":1533,"slug":1534,"type":15},{"name":1550,"slug":1551,"type":15},{"name":1567,"slug":1568,"type":15},"Documentation","documentation",{"name":1536,"slug":1527,"type":15},{"name":1538,"slug":1539,"type":15},"2026-05-16T06:07:47.821474",{"slug":1573,"name":1573,"fn":1574,"description":1575,"org":1576,"tags":1577,"stars":1452,"repoUrl":1453,"updatedAt":1583},"figma-implement-design","translate Figma designs into application code","Translates Figma designs into production-ready application code with 1:1 visual fidelity. Use when implementing UI code from Figma files, when user mentions \"implement design\", \"generate code\", \"implement component\", provides Figma URLs, or asks to build components matching Figma specs. For Figma canvas writes via `use_figma`, use `figma-use`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1578,1579,1580,1581,1582],{"name":1533,"slug":1534,"type":15},{"name":1536,"slug":1527,"type":15},{"name":1538,"slug":1539,"type":15},{"name":1555,"slug":1556,"type":15},{"name":1450,"slug":1451,"type":15},"2026-05-16T06:07:40.583615",{"slug":1585,"name":1585,"fn":1586,"description":1587,"org":1588,"tags":1589,"stars":1452,"repoUrl":1453,"updatedAt":1598},"hatch-pet","create animated pets for Codex","Create, repair, validate, visually QA, and package Codex-compatible animated pets and pet spritesheets from character art, generated images, company or prospect brand cues, or visual references. Use when a user wants a lightweight-worker Codex pet workflow, a non-pixel custom pet style, a prospect or company mascot pet, or a full 8x9 animated pet atlas with transparent unused cells, QA contact sheets, and pet.json packaging. This skill composes the installed $imagegen system skill for visual generation and uses bundled scripts for deterministic spritesheet assembly.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1590,1593,1594,1597],{"name":1591,"slug":1592,"type":15},"Animation","animation",{"name":1485,"slug":1486,"type":15},{"name":1595,"slug":1596,"type":15},"Creative","creative",{"name":1533,"slug":1534,"type":15},"2026-05-02T05:31:48.48485",{"slug":1600,"name":1600,"fn":1601,"description":1602,"org":1603,"tags":1604,"stars":1452,"repoUrl":1453,"updatedAt":1614},"imagegen","generate and edit raster images","Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG\u002Fvector\u002Fcode-native assets, extending an established icon or logo system, or building the visual directly in HTML\u002FCSS\u002Fcanvas.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1605,1606,1607,1610,1613],{"name":1595,"slug":1596,"type":15},{"name":1533,"slug":1534,"type":15},{"name":1608,"slug":1609,"type":15},"Image Generation","image-generation",{"name":1611,"slug":1612,"type":15},"Images","images",{"name":9,"slug":8,"type":15},"2026-05-15T06:23:24.312127",675,{"items":1617,"total":1730},[1618,1634,1650,1662,1680,1698,1718],{"slug":1619,"name":1619,"fn":1620,"description":1621,"org":1622,"tags":1623,"stars":25,"repoUrl":26,"updatedAt":27},"accessibility-and-inclusive-visualization","make data visualizations accessible","Make data visualizations accessible and inclusive. Use when the user needs chart or diagram accessibility guidance, text alternatives for complex visuals, color and contrast review, keyboard support, reduced-motion behavior for animation or parallax, or an accessibility QA workflow for exported figures, UML-like diagrams, and dashboards.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1624,1627,1630,1633],{"name":1625,"slug":1626,"type":15},"Accessibility","accessibility",{"name":1628,"slug":1629,"type":15},"Charts","charts",{"name":1631,"slug":1632,"type":15},"Data Visualization","data-visualization",{"name":1533,"slug":1534,"type":15},{"slug":1635,"name":1635,"fn":1636,"description":1637,"org":1638,"tags":1639,"stars":25,"repoUrl":26,"updatedAt":1649},"agent-browser","automate browser interactions for agents","Browser automation CLI for AI agents. Use when the user needs to interact with websites, verify dev server output, test web apps, navigate pages, fill forms, click buttons, take screenshots, extract data, or automate any browser task. Also triggers when a dev server starts so you can verify it visually.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1640,1643,1646],{"name":1641,"slug":1642,"type":15},"Agents","agents",{"name":1644,"slug":1645,"type":15},"Browser Automation","browser-automation",{"name":1647,"slug":1648,"type":15},"Testing","testing","2026-04-06T18:41:03.44016",{"slug":1651,"name":1651,"fn":1652,"description":1653,"org":1654,"tags":1655,"stars":25,"repoUrl":26,"updatedAt":1661},"agent-browser-verify","verify dev server output with automated browser","Automated browser verification for dev servers. Triggers when a dev server starts to run a visual gut-check with agent-browser — verifies the page loads, checks for console errors, validates key UI elements, and reports pass\u002Ffail before continuing.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1656,1657,1660],{"name":1644,"slug":1645,"type":15},{"name":1658,"slug":1659,"type":15},"Local Development","local-development",{"name":1647,"slug":1648,"type":15},"2026-04-06T18:41:17.526867",{"slug":1663,"name":1663,"fn":1664,"description":1665,"org":1666,"tags":1667,"stars":25,"repoUrl":26,"updatedAt":1679},"agents-sdk","build AI agents on Cloudflare Workers","Build AI agents on Cloudflare Workers using the Agents SDK. Load when creating stateful agents, durable workflows, real-time WebSocket apps, scheduled tasks, MCP servers, or chat applications. Covers Agent class, state management, callable RPC, Workflows integration, and React hooks. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1668,1669,1670,1673,1676],{"name":1641,"slug":1642,"type":15},{"name":1501,"slug":1502,"type":15},{"name":1671,"slug":1672,"type":15},"SDK","sdk",{"name":1674,"slug":1675,"type":15},"Serverless","serverless",{"name":1677,"slug":1678,"type":15},"WebSockets","websockets","2026-04-06T18:39:51.717063",{"slug":1681,"name":1681,"fn":1682,"description":1683,"org":1684,"tags":1685,"stars":25,"repoUrl":26,"updatedAt":1697},"ai-elements","build chat UIs with AI Elements","AI Elements component library guidance — pre-built React components for AI interfaces built on shadcn\u002Fui. Use when building chat UIs, message displays, tool call rendering, streaming responses, reasoning panels, or any AI-native interface with the AI SDK.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1686,1687,1690,1693,1694],{"name":1538,"slug":1539,"type":15},{"name":1688,"slug":1689,"type":15},"React","react",{"name":1691,"slug":1692,"type":15},"shadcn\u002Fui","shadcn-ui",{"name":1555,"slug":1556,"type":15},{"name":1695,"slug":1696,"type":15},"Vercel","vercel","2026-04-06T18:40:59.619419",{"slug":1699,"name":1699,"fn":1700,"description":1701,"org":1702,"tags":1703,"stars":25,"repoUrl":26,"updatedAt":1717},"ai-gateway","configure Vercel AI Gateway","Vercel AI Gateway expert guidance. Use when configuring model routing, provider failover, cost tracking, or managing multiple AI providers through a unified API.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1704,1707,1710,1713,1716],{"name":1705,"slug":1706,"type":15},"AI Infrastructure","ai-infrastructure",{"name":1708,"slug":1709,"type":15},"Cost Optimization","cost-optimization",{"name":1711,"slug":1712,"type":15},"LLM","llm",{"name":1714,"slug":1715,"type":15},"Performance","performance",{"name":1695,"slug":1696,"type":15},"2026-04-06T18:40:44.377464",{"slug":1719,"name":1719,"fn":1720,"description":1721,"org":1722,"tags":1723,"stars":25,"repoUrl":26,"updatedAt":1729},"ai-generation-persistence","implement persistence patterns for AI generations","AI generation persistence patterns — unique IDs, addressable URLs, database storage, and cost tracking for every LLM generation",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1724,1725,1728],{"name":1708,"slug":1709,"type":15},{"name":1726,"slug":1727,"type":15},"Database","database",{"name":1711,"slug":1712,"type":15},"2026-04-06T18:41:08.513425",600]