Providers / Twilio

Messaging

Twilio API keys and credentials

What every Twilio credential a founder holds does, whether it expires, and what tends to break. Each fact links to Twilio's own docs.

Last checked 2026-11-06 · www.twilio.com

At a glance

Each credential

Twilio Console login

• Not documented

Console login. Session and 2FA policy not documented on the pages reviewed. Account owners and administrators receive an email for every Auth Token change.

Twilio docs

Auth Token (primary, with Account SID)

• Not documented
• Full access only

Grants administrative access to the whole account; only one primary per account. Expiry is not documented. Zero-downtime rotation: request a secondary token, deploy it, then promote it, which deletes the old primary (calls using it fail). Services or Functions with hardcoded tokens can return 403 for about a minute after change. Each change emails all owners and administrators.

Twilio docs

Standard API key

• Not documented
• Can be scoped

Grants access to nearly all resources except Accounts and Keys. Used with the key SID as username and key secret as password. The docs describe no expiry or TTL; revoke by deleting the key in the Console. Creation is available in the Console or via the REST API. Whether the secret can be viewed again after creation is not stated; the docs say to copy it when created.

Twilio docs

Restricted API key

• Not documented
• Can be scoped

Fine-grained access to specific Twilio API resources. Available in the Console and, for v1 resources only, via the REST API. Restricted keys are only available in the US region in the legacy Console. No expiry is documented; revoke by deleting.

Twilio docs

Main API key

• Not documented
• Full access only

Full access to all Twilio API resources, equivalent to using the Account SID and Auth Token. Listed in the legacy Console and creatable only in the Console, not via the REST API. Not offered in the current Console per the pages reviewed. No expiry documented.

Twilio docs

What usually goes wrong

• Auth Token rotated by promoting a secondary token without updating every deployed service, so calls fail with authentication errors
• Auth Token hardcoded in Services or Functions (Classic); 403 errors persist until the value is updated and propagates
• Full-access Auth Token or Main API key leaked into client code or logs instead of a Standard or Restricted key
• API key deleted after a team member leaves, breaking messaging or verification flows without warning
• Phone number not renewed or paid, so the number is released and the sender ID changes
• Auth Token change triggers emails to all owners and admins and may be mistaken for an attack

Renewals and billing

• Twilio phone numbers (local, toll-free), billed monthly. Numbers are rented on a recurring monthly fee; per-number price not confirmed on the pricing page reviewed. A third-party search summary cites $1.15/mo for US local and $2.15/mo for toll-free. Verify before relying on it.

Pay-as-you-go usage pricing for messaging, voice and other products, plus recurring monthly fees for phone numbers. No contract or minimum stated on the pricing page. Invoice and spend API availability not confirmed.

What Twilio's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

• Whether the Auth Token or any API key ever expires (none documented; treated as not expiring but not confirmed)
• Whether API key secrets can be viewed again after creation
• Current Console availability of Main API keys
• Whether key expiry or metadata is readable through the API
• Dashboard login session lifetime and 2FA policy
• Whether usage or spend data is available through the API

Rotating or replacing a Twilio key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Sources

• www.twilio.com/docs/iam/api/authtoken
• www.twilio.com/docs/iam/api-keys
• www.twilio.com/docs/iam/api-keys/keys-in-console
• www.twilio.com/en-us/pricing

Keep track of every Twilio key

StackHangar stores your Twilio keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.