[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-twilio-twilio-security-hardening":3,"mdc--ihrkwe-key":33,"related-org-twilio-twilio-security-hardening":1423,"related-repo-twilio-twilio-security-hardening":1599},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":31,"mdContent":32},"twilio-security-hardening","harden Twilio application security","Secure Twilio applications against common attacks. Covers credential management (API keys vs auth tokens), request validation (webhook signature verification), PCI DSS compliance, HIPAA account requirements, SMS pumping prevention, geo-permissions, and account isolation patterns. Use this skill when developers are building or deploying Twilio apps.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"twilio","Twilio","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftwilio.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Compliance","compliance",{"name":20,"slug":21,"type":15},"API Development","api-development",{"name":9,"slug":8,"type":15},25,"https:\u002F\u002Fgithub.com\u002Ftwilio\u002Fai","2026-07-17T06:04:15.700251",null,7,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":26},[],"https:\u002F\u002Fgithub.com\u002Ftwilio\u002Fai\u002Ftree\u002FHEAD\u002Fskills\u002Ftwilio\u002Ftwilio-security-hardening","---\nname: twilio-security-hardening\ndescription: >\n  Secure Twilio applications against common attacks. Covers credential\n  management (API keys vs auth tokens), request validation (webhook\n  signature verification), PCI DSS compliance, HIPAA account requirements,\n  SMS pumping prevention, geo-permissions, and account isolation patterns.\n  Use this skill when developers are building or deploying Twilio apps.\n---\n\n## Overview\n\nSecurity hardening is an **ongoing** concern — not a one-time setup. This skill covers account-level security decisions and application-level protection patterns that prevent credential leaks, fraud, and compliance violations.\n\n**Lifecycle:** Choose numbers (`twilio-numbers-senders`) → Register (`twilio-compliance-onboarding`) → Follow traffic rules (`twilio-compliance-traffic`) → Secure everything (this skill)\n\n---\n\n## Credential Management\n\n### API Keys vs Auth Tokens\n\n| Credential | Scope | Revocable | Use when |\n|-----------|-------|-----------|----------|\n| **Auth Token** | Full account access | Only by rotating (invalidates all token-based integrations and webhook signature validation — API keys unaffected) | Avoid in production — use API keys instead |\n| **API Key + Secret** | Scoped, revocable individually | Yes — revoke one without affecting others | Production applications, CI\u002FCD, server-side code |\n| **Access Tokens** | Short-lived, client-specific | Expire automatically | Client-side SDKs (Voice, Video, Conversations) |\n\n**Critical gotcha:** Rotating your Auth Token invalidates all integrations authenticating with `AccountSID:AuthToken` and breaks webhook signature validation — it does NOT affect API keys (SK-prefixed), which are independent. Use API keys from the start so you rarely need to rotate the Auth Token.\n\n### Best Practices\n\n- Store credentials in environment variables or a secrets manager — never in code\n- Use different API keys per application\u002Fenvironment\n- Rotate API keys on a schedule (quarterly minimum, monthly for HIPAA)\n- Use sub-accounts to isolate customer credentials for ISV platforms — see `twilio-account-setup`\n\n**Docs:** See `twilio-iam-auth-setup` for full credential setup patterns.\n\n---\n\n## Request Validation (Webhook Security)\n\nVerify that webhook requests actually come from Twilio — not spoofed by attackers.\n\n### X-Twilio-Signature Validation\n\nAlways use the SDK validator — don't implement HMAC-SHA1 manually:\n\n**Node.js**\n```javascript\nconst twilio = require(\"twilio\");\n\napp.post(\"\u002Fsms\", (req, res) => {\n    const valid = twilio.validateRequest(\n        process.env.TWILIO_AUTH_TOKEN,\n        req.headers[\"x-twilio-signature\"],\n        `https:\u002F\u002Fyourdomain.com\u002Fsms`,\n        req.body\n    );\n    if (!valid) return res.status(403).send(\"Forbidden\");\n    \u002F\u002F Process webhook...\n});\n```\n\n**Note:** Webhook signature validation always uses your Auth Token — not an API Key Secret. This is the one legitimate production use of the Auth Token. Keep it accessible for request validation but store it securely (environment variable or secrets manager).\n\n**Common mistakes:**\n- Using HTTP URL when Twilio sends to HTTPS (URL must match exactly)\n- Forgetting to include query string parameters in validation URL\n- Not validating in production because \"it worked in dev without it\"\n\n**Docs:** See `twilio-webhook-architecture` for full webhook security patterns.\n\n---\n\n## Account-Level Compliance\n\n### PCI DSS (Payment Card Industry)\n\n**PCI Mode is IRREVERSIBLE and account-wide.** Once enabled, it cannot be disabled — ever.\n\n- All recordings are encrypted\n- Transcript access is restricted\n- Affects every service on the account\n\n**Recommendation:** If you need PCI compliance for one use case, create a **separate sub-account** dedicated to payment-related calls. See `twilio-account-setup` for sub-account patterns.\n\nFor call recording during payment, pause recording when the customer gives card numbers:\n```python\nclient.calls(call_sid).recordings(recording_sid).update(status=\"paused\")\n```\n\nOr use the `\u003CPay>` verb to handle payments without your application touching card data:\n```xml\n\u003CPay paymentConnector=\"stripe_connector\" chargeAmount=\"49.99\" currency=\"usd\" \u002F>\n```\n\n### HIPAA (Healthcare)\n\nBefore handling Protected Health Information (PHI):\n- **Execute a BAA** (Business Associate Agreement) with Twilio — contact your account manager or [submit a sales request](https:\u002F\u002Fwww.twilio.com\u002Fen-us\u002Fhelp\u002Fsales) if you don't have one\n- **Encrypt all recordings** containing PHI\n- **Minimize PHI in TTS** — don't speak full patient details via `\u003CSay>`\n- **Rotate API keys** on a regular schedule\n- **Restrict access** to recordings and transcripts\n\n---\n\n## Fraud Prevention\n\n### SMS Pumping Protection\n\nAttackers trigger thousands of OTP messages to premium-rate numbers, generating toll charges.\n\n**Layered defense:**\n1. **Twilio Verify Fraud Guard** — built-in fraud detection (enable on Verify Service)\n2. **Lookup pre-check** — call `twilio-lookup-phone-intelligence` to check line type + SMS pumping risk score before sending\n3. **Geo-permissions** — restrict SMS\u002Fvoice to countries where you have customers ([Console > Messaging > Geo Permissions](https:\u002F\u002Fconsole.twilio.com))\n4. **Rate limiting** — limit verification attempts per IP, per phone number, per time window\n\n### Geo-Permissions\n\nRestrict which countries can receive messages or calls from your account:\n- Disable all countries you don't serve (SMS and Voice separately)\n- Re-enable only as needed — [configure in Console](https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fmessaging\u002Fguides\u002Fsms-geo-permissions)\n- This is the single most effective anti-fraud measure for SMS pumping\n\n**SMS pumping impact:** Incidents can climb into tens of thousands of dollars. Twilio does not publish most-targeted prefixes — the general guidance is to restrict message termination to countries where you do business via geo-permissions. Customers using Fraud Guard can view estimated fraud savings in their [Fraud Guard reports](https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fverify\u002Fpreventing-toll-fraud\u002Fsms-fraud-guard).\n\n---\n\n## Common Mistakes\n\n1. **Auth Token in code** — Pushed to GitHub, leaked. Use environment variables + API keys.\n2. **No webhook validation** — Attackers can send fake webhook requests to your endpoints.\n3. **PCI Mode on main account** — Irreversible. Use a sub-account for payment use cases.\n4. **No geo-permissions** — Account is open to SMS pumping from any country.\n5. **Auth Token rotation without planning** — Breaks all integrations using `AccountSID:AuthToken` and webhook signature validation simultaneously. API keys are unaffected.\n\n---\n\n## Credential Rotation (Zero-Downtime)\n\nBoth API keys and Auth Tokens follow the same workflow:\n\n1. **Create secondary** — generate a new API key (or note the new Auth Token)\n2. **Operationalize secondary** — deploy the new credential to all services\n3. **Promote secondary to primary** — verify all traffic uses the new credential\n4. **Delete old primary** — revoke the previous credential\n\nManage keys at: `https:\u002F\u002Fconsole.twilio.com\u002Faccount\u002Fkeys-credentials\u002Fapi-keys` (per account).\n\n**Key enabler: use a secrets manager** (AWS Secrets Manager, HashiCorp Vault, etc.) to inject credentials at runtime. This makes rotation near-instantaneous with no downtime — no code changes, no redeployments. Organizations that hard-code credentials into repos, deployment scripts, or `.env` files must manually update every location before deleting the old key.\n\nFor ISVs managing many sub-accounts, automate this with the API Keys REST API across accounts.\n\n---\n\n## Next Steps\n\n- **Credential setup and API key management:** `twilio-iam-auth-setup`\n- **Webhook security and signature validation:** `twilio-webhook-architecture`\n- **Account structure and sub-accounts:** `twilio-account-setup`\n- **Phone intelligence for fraud scoring:** `twilio-lookup-phone-intelligence`\n- **Traffic compliance rules:** `twilio-compliance-traffic`\n",{"data":34,"body":35},{"name":4,"description":6},{"type":36,"children":37},"root",[38,47,61,96,100,106,113,229,247,253,284,302,305,311,316,322,327,335,780,790,798,816,832,835,841,847,857,875,899,904,920,933,949,955,960,1030,1033,1039,1045,1050,1058,1118,1124,1129,1154,1172,1175,1181,1241,1244,1250,1255,1298,1311,1329,1334,1337,1343,1417],{"type":39,"tag":40,"props":41,"children":43},"element","h2",{"id":42},"overview",[44],{"type":45,"value":46},"text","Overview",{"type":39,"tag":48,"props":49,"children":50},"p",{},[51,53,59],{"type":45,"value":52},"Security hardening is an ",{"type":39,"tag":54,"props":55,"children":56},"strong",{},[57],{"type":45,"value":58},"ongoing",{"type":45,"value":60}," concern — not a one-time setup. This skill covers account-level security decisions and application-level protection patterns that prevent credential leaks, fraud, and compliance violations.",{"type":39,"tag":48,"props":62,"children":63},{},[64,69,71,78,80,86,88,94],{"type":39,"tag":54,"props":65,"children":66},{},[67],{"type":45,"value":68},"Lifecycle:",{"type":45,"value":70}," Choose numbers (",{"type":39,"tag":72,"props":73,"children":75},"code",{"className":74},[],[76],{"type":45,"value":77},"twilio-numbers-senders",{"type":45,"value":79},") → Register (",{"type":39,"tag":72,"props":81,"children":83},{"className":82},[],[84],{"type":45,"value":85},"twilio-compliance-onboarding",{"type":45,"value":87},") → Follow traffic rules (",{"type":39,"tag":72,"props":89,"children":91},{"className":90},[],[92],{"type":45,"value":93},"twilio-compliance-traffic",{"type":45,"value":95},") → Secure everything (this skill)",{"type":39,"tag":97,"props":98,"children":99},"hr",{},[],{"type":39,"tag":40,"props":101,"children":103},{"id":102},"credential-management",[104],{"type":45,"value":105},"Credential Management",{"type":39,"tag":107,"props":108,"children":110},"h3",{"id":109},"api-keys-vs-auth-tokens",[111],{"type":45,"value":112},"API Keys vs Auth Tokens",{"type":39,"tag":114,"props":115,"children":116},"table",{},[117,146],{"type":39,"tag":118,"props":119,"children":120},"thead",{},[121],{"type":39,"tag":122,"props":123,"children":124},"tr",{},[125,131,136,141],{"type":39,"tag":126,"props":127,"children":128},"th",{},[129],{"type":45,"value":130},"Credential",{"type":39,"tag":126,"props":132,"children":133},{},[134],{"type":45,"value":135},"Scope",{"type":39,"tag":126,"props":137,"children":138},{},[139],{"type":45,"value":140},"Revocable",{"type":39,"tag":126,"props":142,"children":143},{},[144],{"type":45,"value":145},"Use when",{"type":39,"tag":147,"props":148,"children":149},"tbody",{},[150,177,203],{"type":39,"tag":122,"props":151,"children":152},{},[153,162,167,172],{"type":39,"tag":154,"props":155,"children":156},"td",{},[157],{"type":39,"tag":54,"props":158,"children":159},{},[160],{"type":45,"value":161},"Auth Token",{"type":39,"tag":154,"props":163,"children":164},{},[165],{"type":45,"value":166},"Full account access",{"type":39,"tag":154,"props":168,"children":169},{},[170],{"type":45,"value":171},"Only by rotating (invalidates all token-based integrations and webhook signature validation — API keys unaffected)",{"type":39,"tag":154,"props":173,"children":174},{},[175],{"type":45,"value":176},"Avoid in production — use API keys instead",{"type":39,"tag":122,"props":178,"children":179},{},[180,188,193,198],{"type":39,"tag":154,"props":181,"children":182},{},[183],{"type":39,"tag":54,"props":184,"children":185},{},[186],{"type":45,"value":187},"API Key + Secret",{"type":39,"tag":154,"props":189,"children":190},{},[191],{"type":45,"value":192},"Scoped, revocable individually",{"type":39,"tag":154,"props":194,"children":195},{},[196],{"type":45,"value":197},"Yes — revoke one without affecting others",{"type":39,"tag":154,"props":199,"children":200},{},[201],{"type":45,"value":202},"Production applications, CI\u002FCD, server-side code",{"type":39,"tag":122,"props":204,"children":205},{},[206,214,219,224],{"type":39,"tag":154,"props":207,"children":208},{},[209],{"type":39,"tag":54,"props":210,"children":211},{},[212],{"type":45,"value":213},"Access Tokens",{"type":39,"tag":154,"props":215,"children":216},{},[217],{"type":45,"value":218},"Short-lived, client-specific",{"type":39,"tag":154,"props":220,"children":221},{},[222],{"type":45,"value":223},"Expire automatically",{"type":39,"tag":154,"props":225,"children":226},{},[227],{"type":45,"value":228},"Client-side SDKs (Voice, Video, Conversations)",{"type":39,"tag":48,"props":230,"children":231},{},[232,237,239,245],{"type":39,"tag":54,"props":233,"children":234},{},[235],{"type":45,"value":236},"Critical gotcha:",{"type":45,"value":238}," Rotating your Auth Token invalidates all integrations authenticating with ",{"type":39,"tag":72,"props":240,"children":242},{"className":241},[],[243],{"type":45,"value":244},"AccountSID:AuthToken",{"type":45,"value":246}," and breaks webhook signature validation — it does NOT affect API keys (SK-prefixed), which are independent. Use API keys from the start so you rarely need to rotate the Auth Token.",{"type":39,"tag":107,"props":248,"children":250},{"id":249},"best-practices",[251],{"type":45,"value":252},"Best Practices",{"type":39,"tag":254,"props":255,"children":256},"ul",{},[257,263,268,273],{"type":39,"tag":258,"props":259,"children":260},"li",{},[261],{"type":45,"value":262},"Store credentials in environment variables or a secrets manager — never in code",{"type":39,"tag":258,"props":264,"children":265},{},[266],{"type":45,"value":267},"Use different API keys per application\u002Fenvironment",{"type":39,"tag":258,"props":269,"children":270},{},[271],{"type":45,"value":272},"Rotate API keys on a schedule (quarterly minimum, monthly for HIPAA)",{"type":39,"tag":258,"props":274,"children":275},{},[276,278],{"type":45,"value":277},"Use sub-accounts to isolate customer credentials for ISV platforms — see ",{"type":39,"tag":72,"props":279,"children":281},{"className":280},[],[282],{"type":45,"value":283},"twilio-account-setup",{"type":39,"tag":48,"props":285,"children":286},{},[287,292,294,300],{"type":39,"tag":54,"props":288,"children":289},{},[290],{"type":45,"value":291},"Docs:",{"type":45,"value":293}," See ",{"type":39,"tag":72,"props":295,"children":297},{"className":296},[],[298],{"type":45,"value":299},"twilio-iam-auth-setup",{"type":45,"value":301}," for full credential setup patterns.",{"type":39,"tag":97,"props":303,"children":304},{},[],{"type":39,"tag":40,"props":306,"children":308},{"id":307},"request-validation-webhook-security",[309],{"type":45,"value":310},"Request Validation (Webhook Security)",{"type":39,"tag":48,"props":312,"children":313},{},[314],{"type":45,"value":315},"Verify that webhook requests actually come from Twilio — not spoofed by attackers.",{"type":39,"tag":107,"props":317,"children":319},{"id":318},"x-twilio-signature-validation",[320],{"type":45,"value":321},"X-Twilio-Signature Validation",{"type":39,"tag":48,"props":323,"children":324},{},[325],{"type":45,"value":326},"Always use the SDK validator — don't implement HMAC-SHA1 manually:",{"type":39,"tag":48,"props":328,"children":329},{},[330],{"type":39,"tag":54,"props":331,"children":332},{},[333],{"type":45,"value":334},"Node.js",{"type":39,"tag":336,"props":337,"children":342},"pre",{"className":338,"code":339,"language":340,"meta":341,"style":341},"language-javascript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","const twilio = require(\"twilio\");\n\napp.post(\"\u002Fsms\", (req, res) => {\n    const valid = twilio.validateRequest(\n        process.env.TWILIO_AUTH_TOKEN,\n        req.headers[\"x-twilio-signature\"],\n        `https:\u002F\u002Fyourdomain.com\u002Fsms`,\n        req.body\n    );\n    if (!valid) return res.status(403).send(\"Forbidden\");\n    \u002F\u002F Process webhook...\n});\n","javascript","",[343],{"type":39,"tag":72,"props":344,"children":345},{"__ignoreMap":341},[346,405,415,490,529,561,606,628,645,658,753,763],{"type":39,"tag":347,"props":348,"children":351},"span",{"class":349,"line":350},"line",1,[352,358,364,370,376,381,386,391,395,400],{"type":39,"tag":347,"props":353,"children":355},{"style":354},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[356],{"type":45,"value":357},"const",{"type":39,"tag":347,"props":359,"children":361},{"style":360},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[362],{"type":45,"value":363}," twilio ",{"type":39,"tag":347,"props":365,"children":367},{"style":366},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[368],{"type":45,"value":369},"=",{"type":39,"tag":347,"props":371,"children":373},{"style":372},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[374],{"type":45,"value":375}," require",{"type":39,"tag":347,"props":377,"children":378},{"style":360},[379],{"type":45,"value":380},"(",{"type":39,"tag":347,"props":382,"children":383},{"style":366},[384],{"type":45,"value":385},"\"",{"type":39,"tag":347,"props":387,"children":389},{"style":388},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[390],{"type":45,"value":8},{"type":39,"tag":347,"props":392,"children":393},{"style":366},[394],{"type":45,"value":385},{"type":39,"tag":347,"props":396,"children":397},{"style":360},[398],{"type":45,"value":399},")",{"type":39,"tag":347,"props":401,"children":402},{"style":366},[403],{"type":45,"value":404},";\n",{"type":39,"tag":347,"props":406,"children":408},{"class":349,"line":407},2,[409],{"type":39,"tag":347,"props":410,"children":412},{"emptyLinePlaceholder":411},true,[413],{"type":45,"value":414},"\n",{"type":39,"tag":347,"props":416,"children":418},{"class":349,"line":417},3,[419,424,429,434,438,442,447,451,456,461,467,471,476,480,485],{"type":39,"tag":347,"props":420,"children":421},{"style":360},[422],{"type":45,"value":423},"app",{"type":39,"tag":347,"props":425,"children":426},{"style":366},[427],{"type":45,"value":428},".",{"type":39,"tag":347,"props":430,"children":431},{"style":372},[432],{"type":45,"value":433},"post",{"type":39,"tag":347,"props":435,"children":436},{"style":360},[437],{"type":45,"value":380},{"type":39,"tag":347,"props":439,"children":440},{"style":366},[441],{"type":45,"value":385},{"type":39,"tag":347,"props":443,"children":444},{"style":388},[445],{"type":45,"value":446},"\u002Fsms",{"type":39,"tag":347,"props":448,"children":449},{"style":366},[450],{"type":45,"value":385},{"type":39,"tag":347,"props":452,"children":453},{"style":366},[454],{"type":45,"value":455},",",{"type":39,"tag":347,"props":457,"children":458},{"style":366},[459],{"type":45,"value":460}," (",{"type":39,"tag":347,"props":462,"children":464},{"style":463},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic",[465],{"type":45,"value":466},"req",{"type":39,"tag":347,"props":468,"children":469},{"style":366},[470],{"type":45,"value":455},{"type":39,"tag":347,"props":472,"children":473},{"style":463},[474],{"type":45,"value":475}," res",{"type":39,"tag":347,"props":477,"children":478},{"style":366},[479],{"type":45,"value":399},{"type":39,"tag":347,"props":481,"children":482},{"style":354},[483],{"type":45,"value":484}," =>",{"type":39,"tag":347,"props":486,"children":487},{"style":366},[488],{"type":45,"value":489}," {\n",{"type":39,"tag":347,"props":491,"children":493},{"class":349,"line":492},4,[494,499,504,509,514,518,523],{"type":39,"tag":347,"props":495,"children":496},{"style":354},[497],{"type":45,"value":498},"    const",{"type":39,"tag":347,"props":500,"children":501},{"style":360},[502],{"type":45,"value":503}," valid",{"type":39,"tag":347,"props":505,"children":506},{"style":366},[507],{"type":45,"value":508}," =",{"type":39,"tag":347,"props":510,"children":511},{"style":360},[512],{"type":45,"value":513}," twilio",{"type":39,"tag":347,"props":515,"children":516},{"style":366},[517],{"type":45,"value":428},{"type":39,"tag":347,"props":519,"children":520},{"style":372},[521],{"type":45,"value":522},"validateRequest",{"type":39,"tag":347,"props":524,"children":526},{"style":525},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[527],{"type":45,"value":528},"(\n",{"type":39,"tag":347,"props":530,"children":532},{"class":349,"line":531},5,[533,538,542,547,551,556],{"type":39,"tag":347,"props":534,"children":535},{"style":360},[536],{"type":45,"value":537},"        process",{"type":39,"tag":347,"props":539,"children":540},{"style":366},[541],{"type":45,"value":428},{"type":39,"tag":347,"props":543,"children":544},{"style":360},[545],{"type":45,"value":546},"env",{"type":39,"tag":347,"props":548,"children":549},{"style":366},[550],{"type":45,"value":428},{"type":39,"tag":347,"props":552,"children":553},{"style":360},[554],{"type":45,"value":555},"TWILIO_AUTH_TOKEN",{"type":39,"tag":347,"props":557,"children":558},{"style":366},[559],{"type":45,"value":560},",\n",{"type":39,"tag":347,"props":562,"children":564},{"class":349,"line":563},6,[565,570,574,579,584,588,593,597,602],{"type":39,"tag":347,"props":566,"children":567},{"style":360},[568],{"type":45,"value":569},"        req",{"type":39,"tag":347,"props":571,"children":572},{"style":366},[573],{"type":45,"value":428},{"type":39,"tag":347,"props":575,"children":576},{"style":360},[577],{"type":45,"value":578},"headers",{"type":39,"tag":347,"props":580,"children":581},{"style":525},[582],{"type":45,"value":583},"[",{"type":39,"tag":347,"props":585,"children":586},{"style":366},[587],{"type":45,"value":385},{"type":39,"tag":347,"props":589,"children":590},{"style":388},[591],{"type":45,"value":592},"x-twilio-signature",{"type":39,"tag":347,"props":594,"children":595},{"style":366},[596],{"type":45,"value":385},{"type":39,"tag":347,"props":598,"children":599},{"style":525},[600],{"type":45,"value":601},"]",{"type":39,"tag":347,"props":603,"children":604},{"style":366},[605],{"type":45,"value":560},{"type":39,"tag":347,"props":607,"children":608},{"class":349,"line":27},[609,614,619,624],{"type":39,"tag":347,"props":610,"children":611},{"style":366},[612],{"type":45,"value":613},"        `",{"type":39,"tag":347,"props":615,"children":616},{"style":388},[617],{"type":45,"value":618},"https:\u002F\u002Fyourdomain.com\u002Fsms",{"type":39,"tag":347,"props":620,"children":621},{"style":366},[622],{"type":45,"value":623},"`",{"type":39,"tag":347,"props":625,"children":626},{"style":366},[627],{"type":45,"value":560},{"type":39,"tag":347,"props":629,"children":631},{"class":349,"line":630},8,[632,636,640],{"type":39,"tag":347,"props":633,"children":634},{"style":360},[635],{"type":45,"value":569},{"type":39,"tag":347,"props":637,"children":638},{"style":366},[639],{"type":45,"value":428},{"type":39,"tag":347,"props":641,"children":642},{"style":360},[643],{"type":45,"value":644},"body\n",{"type":39,"tag":347,"props":646,"children":648},{"class":349,"line":647},9,[649,654],{"type":39,"tag":347,"props":650,"children":651},{"style":525},[652],{"type":45,"value":653},"    )",{"type":39,"tag":347,"props":655,"children":656},{"style":366},[657],{"type":45,"value":404},{"type":39,"tag":347,"props":659,"children":661},{"class":349,"line":660},10,[662,668,672,677,682,687,692,696,700,705,709,715,719,723,728,732,736,741,745,749],{"type":39,"tag":347,"props":663,"children":665},{"style":664},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[666],{"type":45,"value":667},"    if",{"type":39,"tag":347,"props":669,"children":670},{"style":525},[671],{"type":45,"value":460},{"type":39,"tag":347,"props":673,"children":674},{"style":366},[675],{"type":45,"value":676},"!",{"type":39,"tag":347,"props":678,"children":679},{"style":360},[680],{"type":45,"value":681},"valid",{"type":39,"tag":347,"props":683,"children":684},{"style":525},[685],{"type":45,"value":686},") ",{"type":39,"tag":347,"props":688,"children":689},{"style":664},[690],{"type":45,"value":691},"return",{"type":39,"tag":347,"props":693,"children":694},{"style":360},[695],{"type":45,"value":475},{"type":39,"tag":347,"props":697,"children":698},{"style":366},[699],{"type":45,"value":428},{"type":39,"tag":347,"props":701,"children":702},{"style":372},[703],{"type":45,"value":704},"status",{"type":39,"tag":347,"props":706,"children":707},{"style":525},[708],{"type":45,"value":380},{"type":39,"tag":347,"props":710,"children":712},{"style":711},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[713],{"type":45,"value":714},"403",{"type":39,"tag":347,"props":716,"children":717},{"style":525},[718],{"type":45,"value":399},{"type":39,"tag":347,"props":720,"children":721},{"style":366},[722],{"type":45,"value":428},{"type":39,"tag":347,"props":724,"children":725},{"style":372},[726],{"type":45,"value":727},"send",{"type":39,"tag":347,"props":729,"children":730},{"style":525},[731],{"type":45,"value":380},{"type":39,"tag":347,"props":733,"children":734},{"style":366},[735],{"type":45,"value":385},{"type":39,"tag":347,"props":737,"children":738},{"style":388},[739],{"type":45,"value":740},"Forbidden",{"type":39,"tag":347,"props":742,"children":743},{"style":366},[744],{"type":45,"value":385},{"type":39,"tag":347,"props":746,"children":747},{"style":525},[748],{"type":45,"value":399},{"type":39,"tag":347,"props":750,"children":751},{"style":366},[752],{"type":45,"value":404},{"type":39,"tag":347,"props":754,"children":756},{"class":349,"line":755},11,[757],{"type":39,"tag":347,"props":758,"children":760},{"style":759},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[761],{"type":45,"value":762},"    \u002F\u002F Process webhook...\n",{"type":39,"tag":347,"props":764,"children":766},{"class":349,"line":765},12,[767,772,776],{"type":39,"tag":347,"props":768,"children":769},{"style":366},[770],{"type":45,"value":771},"}",{"type":39,"tag":347,"props":773,"children":774},{"style":360},[775],{"type":45,"value":399},{"type":39,"tag":347,"props":777,"children":778},{"style":366},[779],{"type":45,"value":404},{"type":39,"tag":48,"props":781,"children":782},{},[783,788],{"type":39,"tag":54,"props":784,"children":785},{},[786],{"type":45,"value":787},"Note:",{"type":45,"value":789}," Webhook signature validation always uses your Auth Token — not an API Key Secret. This is the one legitimate production use of the Auth Token. Keep it accessible for request validation but store it securely (environment variable or secrets manager).",{"type":39,"tag":48,"props":791,"children":792},{},[793],{"type":39,"tag":54,"props":794,"children":795},{},[796],{"type":45,"value":797},"Common mistakes:",{"type":39,"tag":254,"props":799,"children":800},{},[801,806,811],{"type":39,"tag":258,"props":802,"children":803},{},[804],{"type":45,"value":805},"Using HTTP URL when Twilio sends to HTTPS (URL must match exactly)",{"type":39,"tag":258,"props":807,"children":808},{},[809],{"type":45,"value":810},"Forgetting to include query string parameters in validation URL",{"type":39,"tag":258,"props":812,"children":813},{},[814],{"type":45,"value":815},"Not validating in production because \"it worked in dev without it\"",{"type":39,"tag":48,"props":817,"children":818},{},[819,823,824,830],{"type":39,"tag":54,"props":820,"children":821},{},[822],{"type":45,"value":291},{"type":45,"value":293},{"type":39,"tag":72,"props":825,"children":827},{"className":826},[],[828],{"type":45,"value":829},"twilio-webhook-architecture",{"type":45,"value":831}," for full webhook security patterns.",{"type":39,"tag":97,"props":833,"children":834},{},[],{"type":39,"tag":40,"props":836,"children":838},{"id":837},"account-level-compliance",[839],{"type":45,"value":840},"Account-Level Compliance",{"type":39,"tag":107,"props":842,"children":844},{"id":843},"pci-dss-payment-card-industry",[845],{"type":45,"value":846},"PCI DSS (Payment Card Industry)",{"type":39,"tag":48,"props":848,"children":849},{},[850,855],{"type":39,"tag":54,"props":851,"children":852},{},[853],{"type":45,"value":854},"PCI Mode is IRREVERSIBLE and account-wide.",{"type":45,"value":856}," Once enabled, it cannot be disabled — ever.",{"type":39,"tag":254,"props":858,"children":859},{},[860,865,870],{"type":39,"tag":258,"props":861,"children":862},{},[863],{"type":45,"value":864},"All recordings are encrypted",{"type":39,"tag":258,"props":866,"children":867},{},[868],{"type":45,"value":869},"Transcript access is restricted",{"type":39,"tag":258,"props":871,"children":872},{},[873],{"type":45,"value":874},"Affects every service on the account",{"type":39,"tag":48,"props":876,"children":877},{},[878,883,885,890,892,897],{"type":39,"tag":54,"props":879,"children":880},{},[881],{"type":45,"value":882},"Recommendation:",{"type":45,"value":884}," If you need PCI compliance for one use case, create a ",{"type":39,"tag":54,"props":886,"children":887},{},[888],{"type":45,"value":889},"separate sub-account",{"type":45,"value":891}," dedicated to payment-related calls. See ",{"type":39,"tag":72,"props":893,"children":895},{"className":894},[],[896],{"type":45,"value":283},{"type":45,"value":898}," for sub-account patterns.",{"type":39,"tag":48,"props":900,"children":901},{},[902],{"type":45,"value":903},"For call recording during payment, pause recording when the customer gives card numbers:",{"type":39,"tag":336,"props":905,"children":909},{"className":906,"code":907,"language":908,"meta":341,"style":341},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","client.calls(call_sid).recordings(recording_sid).update(status=\"paused\")\n","python",[910],{"type":39,"tag":72,"props":911,"children":912},{"__ignoreMap":341},[913],{"type":39,"tag":347,"props":914,"children":915},{"class":349,"line":350},[916],{"type":39,"tag":347,"props":917,"children":918},{},[919],{"type":45,"value":907},{"type":39,"tag":48,"props":921,"children":922},{},[923,925,931],{"type":45,"value":924},"Or use the ",{"type":39,"tag":72,"props":926,"children":928},{"className":927},[],[929],{"type":45,"value":930},"\u003CPay>",{"type":45,"value":932}," verb to handle payments without your application touching card data:",{"type":39,"tag":336,"props":934,"children":938},{"className":935,"code":936,"language":937,"meta":341,"style":341},"language-xml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u003CPay paymentConnector=\"stripe_connector\" chargeAmount=\"49.99\" currency=\"usd\" \u002F>\n","xml",[939],{"type":39,"tag":72,"props":940,"children":941},{"__ignoreMap":341},[942],{"type":39,"tag":347,"props":943,"children":944},{"class":349,"line":350},[945],{"type":39,"tag":347,"props":946,"children":947},{},[948],{"type":45,"value":936},{"type":39,"tag":107,"props":950,"children":952},{"id":951},"hipaa-healthcare",[953],{"type":45,"value":954},"HIPAA (Healthcare)",{"type":39,"tag":48,"props":956,"children":957},{},[958],{"type":45,"value":959},"Before handling Protected Health Information (PHI):",{"type":39,"tag":254,"props":961,"children":962},{},[963,984,994,1010,1020],{"type":39,"tag":258,"props":964,"children":965},{},[966,971,973,982],{"type":39,"tag":54,"props":967,"children":968},{},[969],{"type":45,"value":970},"Execute a BAA",{"type":45,"value":972}," (Business Associate Agreement) with Twilio — contact your account manager or ",{"type":39,"tag":974,"props":975,"children":979},"a",{"href":976,"rel":977},"https:\u002F\u002Fwww.twilio.com\u002Fen-us\u002Fhelp\u002Fsales",[978],"nofollow",[980],{"type":45,"value":981},"submit a sales request",{"type":45,"value":983}," if you don't have one",{"type":39,"tag":258,"props":985,"children":986},{},[987,992],{"type":39,"tag":54,"props":988,"children":989},{},[990],{"type":45,"value":991},"Encrypt all recordings",{"type":45,"value":993}," containing PHI",{"type":39,"tag":258,"props":995,"children":996},{},[997,1002,1004],{"type":39,"tag":54,"props":998,"children":999},{},[1000],{"type":45,"value":1001},"Minimize PHI in TTS",{"type":45,"value":1003}," — don't speak full patient details via ",{"type":39,"tag":72,"props":1005,"children":1007},{"className":1006},[],[1008],{"type":45,"value":1009},"\u003CSay>",{"type":39,"tag":258,"props":1011,"children":1012},{},[1013,1018],{"type":39,"tag":54,"props":1014,"children":1015},{},[1016],{"type":45,"value":1017},"Rotate API keys",{"type":45,"value":1019}," on a regular schedule",{"type":39,"tag":258,"props":1021,"children":1022},{},[1023,1028],{"type":39,"tag":54,"props":1024,"children":1025},{},[1026],{"type":45,"value":1027},"Restrict access",{"type":45,"value":1029}," to recordings and transcripts",{"type":39,"tag":97,"props":1031,"children":1032},{},[],{"type":39,"tag":40,"props":1034,"children":1036},{"id":1035},"fraud-prevention",[1037],{"type":45,"value":1038},"Fraud Prevention",{"type":39,"tag":107,"props":1040,"children":1042},{"id":1041},"sms-pumping-protection",[1043],{"type":45,"value":1044},"SMS Pumping Protection",{"type":39,"tag":48,"props":1046,"children":1047},{},[1048],{"type":45,"value":1049},"Attackers trigger thousands of OTP messages to premium-rate numbers, generating toll charges.",{"type":39,"tag":48,"props":1051,"children":1052},{},[1053],{"type":39,"tag":54,"props":1054,"children":1055},{},[1056],{"type":45,"value":1057},"Layered defense:",{"type":39,"tag":1059,"props":1060,"children":1061},"ol",{},[1062,1072,1090,1108],{"type":39,"tag":258,"props":1063,"children":1064},{},[1065,1070],{"type":39,"tag":54,"props":1066,"children":1067},{},[1068],{"type":45,"value":1069},"Twilio Verify Fraud Guard",{"type":45,"value":1071}," — built-in fraud detection (enable on Verify Service)",{"type":39,"tag":258,"props":1073,"children":1074},{},[1075,1080,1082,1088],{"type":39,"tag":54,"props":1076,"children":1077},{},[1078],{"type":45,"value":1079},"Lookup pre-check",{"type":45,"value":1081}," — call ",{"type":39,"tag":72,"props":1083,"children":1085},{"className":1084},[],[1086],{"type":45,"value":1087},"twilio-lookup-phone-intelligence",{"type":45,"value":1089}," to check line type + SMS pumping risk score before sending",{"type":39,"tag":258,"props":1091,"children":1092},{},[1093,1098,1100,1107],{"type":39,"tag":54,"props":1094,"children":1095},{},[1096],{"type":45,"value":1097},"Geo-permissions",{"type":45,"value":1099}," — restrict SMS\u002Fvoice to countries where you have customers (",{"type":39,"tag":974,"props":1101,"children":1104},{"href":1102,"rel":1103},"https:\u002F\u002Fconsole.twilio.com",[978],[1105],{"type":45,"value":1106},"Console > Messaging > Geo Permissions",{"type":45,"value":399},{"type":39,"tag":258,"props":1109,"children":1110},{},[1111,1116],{"type":39,"tag":54,"props":1112,"children":1113},{},[1114],{"type":45,"value":1115},"Rate limiting",{"type":45,"value":1117}," — limit verification attempts per IP, per phone number, per time window",{"type":39,"tag":107,"props":1119,"children":1121},{"id":1120},"geo-permissions",[1122],{"type":45,"value":1123},"Geo-Permissions",{"type":39,"tag":48,"props":1125,"children":1126},{},[1127],{"type":45,"value":1128},"Restrict which countries can receive messages or calls from your account:",{"type":39,"tag":254,"props":1130,"children":1131},{},[1132,1137,1149],{"type":39,"tag":258,"props":1133,"children":1134},{},[1135],{"type":45,"value":1136},"Disable all countries you don't serve (SMS and Voice separately)",{"type":39,"tag":258,"props":1138,"children":1139},{},[1140,1142],{"type":45,"value":1141},"Re-enable only as needed — ",{"type":39,"tag":974,"props":1143,"children":1146},{"href":1144,"rel":1145},"https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fmessaging\u002Fguides\u002Fsms-geo-permissions",[978],[1147],{"type":45,"value":1148},"configure in Console",{"type":39,"tag":258,"props":1150,"children":1151},{},[1152],{"type":45,"value":1153},"This is the single most effective anti-fraud measure for SMS pumping",{"type":39,"tag":48,"props":1155,"children":1156},{},[1157,1162,1164,1171],{"type":39,"tag":54,"props":1158,"children":1159},{},[1160],{"type":45,"value":1161},"SMS pumping impact:",{"type":45,"value":1163}," Incidents can climb into tens of thousands of dollars. Twilio does not publish most-targeted prefixes — the general guidance is to restrict message termination to countries where you do business via geo-permissions. Customers using Fraud Guard can view estimated fraud savings in their ",{"type":39,"tag":974,"props":1165,"children":1168},{"href":1166,"rel":1167},"https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fverify\u002Fpreventing-toll-fraud\u002Fsms-fraud-guard",[978],[1169],{"type":45,"value":1170},"Fraud Guard reports",{"type":45,"value":428},{"type":39,"tag":97,"props":1173,"children":1174},{},[],{"type":39,"tag":40,"props":1176,"children":1178},{"id":1177},"common-mistakes",[1179],{"type":45,"value":1180},"Common Mistakes",{"type":39,"tag":1059,"props":1182,"children":1183},{},[1184,1194,1204,1214,1224],{"type":39,"tag":258,"props":1185,"children":1186},{},[1187,1192],{"type":39,"tag":54,"props":1188,"children":1189},{},[1190],{"type":45,"value":1191},"Auth Token in code",{"type":45,"value":1193}," — Pushed to GitHub, leaked. Use environment variables + API keys.",{"type":39,"tag":258,"props":1195,"children":1196},{},[1197,1202],{"type":39,"tag":54,"props":1198,"children":1199},{},[1200],{"type":45,"value":1201},"No webhook validation",{"type":45,"value":1203}," — Attackers can send fake webhook requests to your endpoints.",{"type":39,"tag":258,"props":1205,"children":1206},{},[1207,1212],{"type":39,"tag":54,"props":1208,"children":1209},{},[1210],{"type":45,"value":1211},"PCI Mode on main account",{"type":45,"value":1213}," — Irreversible. Use a sub-account for payment use cases.",{"type":39,"tag":258,"props":1215,"children":1216},{},[1217,1222],{"type":39,"tag":54,"props":1218,"children":1219},{},[1220],{"type":45,"value":1221},"No geo-permissions",{"type":45,"value":1223}," — Account is open to SMS pumping from any country.",{"type":39,"tag":258,"props":1225,"children":1226},{},[1227,1232,1234,1239],{"type":39,"tag":54,"props":1228,"children":1229},{},[1230],{"type":45,"value":1231},"Auth Token rotation without planning",{"type":45,"value":1233}," — Breaks all integrations using ",{"type":39,"tag":72,"props":1235,"children":1237},{"className":1236},[],[1238],{"type":45,"value":244},{"type":45,"value":1240}," and webhook signature validation simultaneously. API keys are unaffected.",{"type":39,"tag":97,"props":1242,"children":1243},{},[],{"type":39,"tag":40,"props":1245,"children":1247},{"id":1246},"credential-rotation-zero-downtime",[1248],{"type":45,"value":1249},"Credential Rotation (Zero-Downtime)",{"type":39,"tag":48,"props":1251,"children":1252},{},[1253],{"type":45,"value":1254},"Both API keys and Auth Tokens follow the same workflow:",{"type":39,"tag":1059,"props":1256,"children":1257},{},[1258,1268,1278,1288],{"type":39,"tag":258,"props":1259,"children":1260},{},[1261,1266],{"type":39,"tag":54,"props":1262,"children":1263},{},[1264],{"type":45,"value":1265},"Create secondary",{"type":45,"value":1267}," — generate a new API key (or note the new Auth Token)",{"type":39,"tag":258,"props":1269,"children":1270},{},[1271,1276],{"type":39,"tag":54,"props":1272,"children":1273},{},[1274],{"type":45,"value":1275},"Operationalize secondary",{"type":45,"value":1277}," — deploy the new credential to all services",{"type":39,"tag":258,"props":1279,"children":1280},{},[1281,1286],{"type":39,"tag":54,"props":1282,"children":1283},{},[1284],{"type":45,"value":1285},"Promote secondary to primary",{"type":45,"value":1287}," — verify all traffic uses the new credential",{"type":39,"tag":258,"props":1289,"children":1290},{},[1291,1296],{"type":39,"tag":54,"props":1292,"children":1293},{},[1294],{"type":45,"value":1295},"Delete old primary",{"type":45,"value":1297}," — revoke the previous credential",{"type":39,"tag":48,"props":1299,"children":1300},{},[1301,1303,1309],{"type":45,"value":1302},"Manage keys at: ",{"type":39,"tag":72,"props":1304,"children":1306},{"className":1305},[],[1307],{"type":45,"value":1308},"https:\u002F\u002Fconsole.twilio.com\u002Faccount\u002Fkeys-credentials\u002Fapi-keys",{"type":45,"value":1310}," (per account).",{"type":39,"tag":48,"props":1312,"children":1313},{},[1314,1319,1321,1327],{"type":39,"tag":54,"props":1315,"children":1316},{},[1317],{"type":45,"value":1318},"Key enabler: use a secrets manager",{"type":45,"value":1320}," (AWS Secrets Manager, HashiCorp Vault, etc.) to inject credentials at runtime. This makes rotation near-instantaneous with no downtime — no code changes, no redeployments. Organizations that hard-code credentials into repos, deployment scripts, or ",{"type":39,"tag":72,"props":1322,"children":1324},{"className":1323},[],[1325],{"type":45,"value":1326},".env",{"type":45,"value":1328}," files must manually update every location before deleting the old key.",{"type":39,"tag":48,"props":1330,"children":1331},{},[1332],{"type":45,"value":1333},"For ISVs managing many sub-accounts, automate this with the API Keys REST API across accounts.",{"type":39,"tag":97,"props":1335,"children":1336},{},[],{"type":39,"tag":40,"props":1338,"children":1340},{"id":1339},"next-steps",[1341],{"type":45,"value":1342},"Next Steps",{"type":39,"tag":254,"props":1344,"children":1345},{},[1346,1361,1375,1389,1403],{"type":39,"tag":258,"props":1347,"children":1348},{},[1349,1354,1356],{"type":39,"tag":54,"props":1350,"children":1351},{},[1352],{"type":45,"value":1353},"Credential setup and API key management:",{"type":45,"value":1355}," ",{"type":39,"tag":72,"props":1357,"children":1359},{"className":1358},[],[1360],{"type":45,"value":299},{"type":39,"tag":258,"props":1362,"children":1363},{},[1364,1369,1370],{"type":39,"tag":54,"props":1365,"children":1366},{},[1367],{"type":45,"value":1368},"Webhook security and signature validation:",{"type":45,"value":1355},{"type":39,"tag":72,"props":1371,"children":1373},{"className":1372},[],[1374],{"type":45,"value":829},{"type":39,"tag":258,"props":1376,"children":1377},{},[1378,1383,1384],{"type":39,"tag":54,"props":1379,"children":1380},{},[1381],{"type":45,"value":1382},"Account structure and sub-accounts:",{"type":45,"value":1355},{"type":39,"tag":72,"props":1385,"children":1387},{"className":1386},[],[1388],{"type":45,"value":283},{"type":39,"tag":258,"props":1390,"children":1391},{},[1392,1397,1398],{"type":39,"tag":54,"props":1393,"children":1394},{},[1395],{"type":45,"value":1396},"Phone intelligence for fraud scoring:",{"type":45,"value":1355},{"type":39,"tag":72,"props":1399,"children":1401},{"className":1400},[],[1402],{"type":45,"value":1087},{"type":39,"tag":258,"props":1404,"children":1405},{},[1406,1411,1412],{"type":39,"tag":54,"props":1407,"children":1408},{},[1409],{"type":45,"value":1410},"Traffic compliance rules:",{"type":45,"value":1355},{"type":39,"tag":72,"props":1413,"children":1415},{"className":1414},[],[1416],{"type":45,"value":93},{"type":39,"tag":1418,"props":1419,"children":1420},"style",{},[1421],{"type":45,"value":1422},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1424,"total":1598},[1425,1438,1458,1469,1481,1494,1511,1526,1539,1552,1568,1586],{"slug":283,"name":283,"fn":1426,"description":1427,"org":1428,"tags":1429,"stars":23,"repoUrl":24,"updatedAt":1437},"configure Twilio accounts and credentials","Create and configure a Twilio account from scratch. Covers free trial signup, trial limitations, getting credentials (Account SID and Auth Token), buying a phone number, verifying recipient numbers for trial use, SDK installation, first API call, subaccount management (creation, inheritance, credential isolation, limits), and enabling specific products (AI Assistants, Conversations, Verify, ConversationRelay, WhatsApp). Use this skill before any other Twilio skill if you do not yet have a Twilio account or need to enable a product. For Organization-level governance (SSO, SCIM, multi-team), see `twilio-organizations-setup`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1430,1431,1434],{"name":20,"slug":21,"type":15},{"name":1432,"slug":1433,"type":15},"Communications","communications",{"name":1435,"slug":1436,"type":15},"SMS","sms","2026-08-01T05:43:28.968968",{"slug":1439,"name":1439,"fn":1440,"description":1441,"org":1442,"tags":1443,"stars":23,"repoUrl":24,"updatedAt":1457},"twilio-agent-augmentation-architect","augment human agents with AI intelligence","Planning skill for augmenting human agents with real-time AI intelligence. Qualifies the developer's use case across coaching, compliance, QA, and routing to recommend the right Conversation Intelligence + Conversation Memory + TaskRouter architecture. Handles both \"I want to add AI coaching to my call center\" and \"configure Conversation Intelligence operators for script adherence.\"\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1444,1447,1450,1453,1456],{"name":1445,"slug":1446,"type":15},"Agents","agents",{"name":1448,"slug":1449,"type":15},"AI","ai",{"name":1451,"slug":1452,"type":15},"Coaching","coaching",{"name":1454,"slug":1455,"type":15},"QA","qa",{"name":9,"slug":8,"type":15},"2026-07-17T06:07:58.250609",{"slug":1459,"name":1459,"fn":1460,"description":1461,"org":1462,"tags":1463,"stars":23,"repoUrl":24,"updatedAt":1468},"twilio-agent-connect","connect AI agents to Twilio channels","Connect third-party AI agents (OpenAI, Bedrock, LangChain, Microsoft Foundry) to Twilio's communication channels using the Twilio Agent Connect SDK. Covers identity resolution, memory and context management via Conversation Memory, conversation orchestration via Conversation Orchestrator, multi-channel handling (Voice, SMS, RCS, WhatsApp, Chat), and AI-to-human escalation. Use this skill when integrating an existing LLM agent with Twilio services.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1464,1465,1466,1467],{"name":1445,"slug":1446,"type":15},{"name":20,"slug":21,"type":15},{"name":1432,"slug":1433,"type":15},{"name":9,"slug":8,"type":15},"2026-07-17T06:06:05.217098",{"slug":1470,"name":1470,"fn":1471,"description":1472,"org":1473,"tags":1474,"stars":23,"repoUrl":24,"updatedAt":1480},"twilio-ai-agent-architect","plan Twilio conversational AI agents","Planning skill for AI-powered conversational agents. Qualifies the developer's use case across outcome sophistication, entry point, and customer profile to recommend the right Twilio Conversations architecture and implementation skills. Handles both high-level requests (\"build me a voice AI assistant\") and specific ones (\"integrate ConversationRelay with my OpenAI backend\").\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1475,1476,1479],{"name":1445,"slug":1446,"type":15},{"name":1477,"slug":1478,"type":15},"Architecture","architecture",{"name":9,"slug":8,"type":15},"2026-07-17T06:07:48.883723",{"slug":1482,"name":1482,"fn":1483,"description":1484,"org":1485,"tags":1486,"stars":23,"repoUrl":24,"updatedAt":1493},"twilio-call-recordings","record and manage Twilio voice calls","Record Twilio voice calls correctly. Covers the critical distinction between Record verb (voicemail) and Dial record (call recording), dual-channel for QA, mid-call pause for PCI, Conference recording, and the ConversationRelay workaround. Use this skill whenever you need to capture call audio for compliance, QA, or analytics.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1487,1490,1491,1492],{"name":1488,"slug":1489,"type":15},"Audio","audio",{"name":17,"slug":18,"type":15},{"name":1454,"slug":1455,"type":15},{"name":9,"slug":8,"type":15},"2026-07-17T06:07:55.268412",{"slug":1495,"name":1495,"fn":1496,"description":1497,"org":1498,"tags":1499,"stars":23,"repoUrl":24,"updatedAt":1510},"twilio-cli-reference","manage Twilio resources via CLI","Twilio CLI reference for managing Twilio resources from the terminal. Covers installation, credential profiles, phone number provisioning, sending SMS and email, webhook configuration, local development with a tunneling service, debugging with watch and logs, serverless deployment, and plugin ecosystem. Use when the developer asks to \"just do it\", \"set this up\", \"run a command\", mentions \"CLI\", \"command line\", or \"terminal\", or when an AI agent can execute a task directly instead of writing application code.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1500,1503,1506,1509],{"name":1501,"slug":1502,"type":15},"CLI","cli",{"name":1504,"slug":1505,"type":15},"Local Development","local-development",{"name":1507,"slug":1508,"type":15},"Operations","operations",{"name":9,"slug":8,"type":15},"2026-07-17T06:07:54.925664",{"slug":85,"name":85,"fn":1512,"description":1513,"org":1514,"tags":1515,"stars":23,"repoUrl":24,"updatedAt":1525},"manage Twilio messaging and voice compliance","Registrations required BEFORE Twilio traffic works. Covers messaging programs (A2P 10DLC, toll-free verification, WhatsApp WABA, RCS, short code, alphanumeric sender) and voice trust programs (STIR\u002FSHAKEN, Voice Integrity, Branded Calling, CNAM). Each number\u002Fsender type has its own program — registration blocks traffic until complete.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1516,1517,1520,1521,1522],{"name":17,"slug":18,"type":15},{"name":1518,"slug":1519,"type":15},"Messaging","messaging",{"name":1435,"slug":1436,"type":15},{"name":9,"slug":8,"type":15},{"name":1523,"slug":1524,"type":15},"WhatsApp","whatsapp","2026-07-17T06:05:47.897229",{"slug":93,"name":93,"fn":1527,"description":1528,"org":1529,"tags":1530,"stars":23,"repoUrl":24,"updatedAt":1538},"ensure compliance for Twilio messaging traffic","Rules you must follow for Twilio messaging and voice traffic. Covers TCPA (consent tiers, quiet hours, DNC), GDPR (EU consent, right to deletion), PCI DSS (payment recording, Pay verb), HIPAA (BAA, PHI), FDCPA (debt collection limits), CAN-SPAM, WhatsApp policies, SHAKEN\u002FSTIR, and consent management patterns. Use this skill proactively when developers have working traffic to ensure they follow the rules.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1531,1532,1533,1536,1537],{"name":17,"slug":18,"type":15},{"name":1518,"slug":1519,"type":15},{"name":1534,"slug":1535,"type":15},"Regulatory Compliance","regulatory-compliance",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-07-17T06:07:55.952779",{"slug":1540,"name":1540,"fn":1541,"description":1542,"org":1543,"tags":1544,"stars":23,"repoUrl":24,"updatedAt":1551},"twilio-conference-calls","build multi-party calls with Twilio Conference","Build multi-party calls using Twilio Conference. Covers warm transfer, cold transfer, coaching (whisper), hold vs mute, participant modes, and supervisor barge. Use this skill for any contact center, support line, or scenario requiring transfers, holds, or multi-party calls.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1545,1546,1547,1550],{"name":1488,"slug":1489,"type":15},{"name":1432,"slug":1433,"type":15},{"name":1548,"slug":1549,"type":15},"Meetings","meetings",{"name":9,"slug":8,"type":15},"2026-07-17T06:07:55.603708",{"slug":1553,"name":1553,"fn":1554,"description":1555,"org":1556,"tags":1557,"stars":23,"repoUrl":24,"updatedAt":1567},"twilio-content-template-builder","create and send message templates with Twilio","Create, manage, and send message templates using Twilio's Content API. Covers template creation for WhatsApp, SMS, RCS, and MMS; variable usage; WhatsApp Meta approval; and sending templates via ContentSid. Use this skill when building structured messages that require pre-approval or consistent formatting across channels.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1558,1561,1562,1563,1566],{"name":1559,"slug":1560,"type":15},"Email","email",{"name":1518,"slug":1519,"type":15},{"name":1435,"slug":1436,"type":15},{"name":1564,"slug":1565,"type":15},"Templates","templates",{"name":9,"slug":8,"type":15},"2026-07-17T06:04:26.637309",{"slug":1569,"name":1569,"fn":1570,"description":1571,"org":1572,"tags":1573,"stars":23,"repoUrl":24,"updatedAt":1585},"twilio-conversation-intelligence","build conversation intelligence pipelines","Twilio Conversation Intelligence development guide. Use when building real-time or post-call conversation analysis, language operator pipelines, sentiment analysis, agent assist, cross-channel analytics, or querying aggregated conversation insights (sentiment trends, escalation rates, dashboards).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1574,1575,1578,1581,1584],{"name":1445,"slug":1446,"type":15},{"name":1576,"slug":1577,"type":15},"Analytics","analytics",{"name":1579,"slug":1580,"type":15},"Monitoring","monitoring",{"name":1582,"slug":1583,"type":15},"NLP","nlp",{"name":9,"slug":8,"type":15},"2026-07-17T06:07:52.545387",{"slug":1587,"name":1587,"fn":1588,"description":1589,"org":1590,"tags":1591,"stars":23,"repoUrl":24,"updatedAt":1597},"twilio-conversation-memory","manage conversation memory with Twilio","Store and retrieve conversation context using Twilio Conversation Memory. Covers Memory Store provisioning, profile management, traits, observations, conversation summaries, and semantic Recall. Use this skill to give AI agents or human agents persistent memory of conversations across sessions and channels.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1592,1593,1596],{"name":1445,"slug":1446,"type":15},{"name":1594,"slug":1595,"type":15},"Memory","memory",{"name":9,"slug":8,"type":15},"2026-07-17T06:04:19.526724",57,{"items":1600,"total":1598},[1601,1607,1615,1622,1628,1635,1642],{"slug":283,"name":283,"fn":1426,"description":1427,"org":1602,"tags":1603,"stars":23,"repoUrl":24,"updatedAt":1437},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1604,1605,1606],{"name":20,"slug":21,"type":15},{"name":1432,"slug":1433,"type":15},{"name":1435,"slug":1436,"type":15},{"slug":1439,"name":1439,"fn":1440,"description":1441,"org":1608,"tags":1609,"stars":23,"repoUrl":24,"updatedAt":1457},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1610,1611,1612,1613,1614],{"name":1445,"slug":1446,"type":15},{"name":1448,"slug":1449,"type":15},{"name":1451,"slug":1452,"type":15},{"name":1454,"slug":1455,"type":15},{"name":9,"slug":8,"type":15},{"slug":1459,"name":1459,"fn":1460,"description":1461,"org":1616,"tags":1617,"stars":23,"repoUrl":24,"updatedAt":1468},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1618,1619,1620,1621],{"name":1445,"slug":1446,"type":15},{"name":20,"slug":21,"type":15},{"name":1432,"slug":1433,"type":15},{"name":9,"slug":8,"type":15},{"slug":1470,"name":1470,"fn":1471,"description":1472,"org":1623,"tags":1624,"stars":23,"repoUrl":24,"updatedAt":1480},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1625,1626,1627],{"name":1445,"slug":1446,"type":15},{"name":1477,"slug":1478,"type":15},{"name":9,"slug":8,"type":15},{"slug":1482,"name":1482,"fn":1483,"description":1484,"org":1629,"tags":1630,"stars":23,"repoUrl":24,"updatedAt":1493},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1631,1632,1633,1634],{"name":1488,"slug":1489,"type":15},{"name":17,"slug":18,"type":15},{"name":1454,"slug":1455,"type":15},{"name":9,"slug":8,"type":15},{"slug":1495,"name":1495,"fn":1496,"description":1497,"org":1636,"tags":1637,"stars":23,"repoUrl":24,"updatedAt":1510},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1638,1639,1640,1641],{"name":1501,"slug":1502,"type":15},{"name":1504,"slug":1505,"type":15},{"name":1507,"slug":1508,"type":15},{"name":9,"slug":8,"type":15},{"slug":85,"name":85,"fn":1512,"description":1513,"org":1643,"tags":1644,"stars":23,"repoUrl":24,"updatedAt":1525},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1645,1646,1647,1648,1649],{"name":17,"slug":18,"type":15},{"name":1518,"slug":1519,"type":15},{"name":1435,"slug":1436,"type":15},{"name":9,"slug":8,"type":15},{"name":1523,"slug":1524,"type":15}]