Twilio
Twilio is how your app reaches a phone number directly: a text message, a one-time passcode for sign-in, or a WhatsApp message. Connect it inside a project and the agent can generate phone-OTP, SMS, and WhatsApp integration code for that project, with secrets kept off the device.
What you get by connecting it
With Twilio connected, the agent can:
- Sign people in by phone number. It wires the one-time-passcode flow on top of Twilio Verify - the user enters their number, receives a code, and types it back in. Verify generates, sends, and checks the codes for you, so the app never has to store or compare them.
- Send SMS. Order confirmations, alerts, reminders, and other transactional or notification messages, sent from your Twilio number or messaging service.
- Message over WhatsApp. Reach customers on WhatsApp using the same account, for the conversations where that fits better than a text.
Every one of these calls runs through a small server-side relay so Twilio credentials stay off the device.
Connecting it
Twilio needs an Account SID (it starts with AC) plus one validation credential. Prefer a dedicated Restricted API Key SID and secret with only /twilio/billing/usage/read; Appsanic uses it for a non-PII, Account-SID-bound Usage Records check. An Auth Token from a dedicated account or subaccount is the fallback. For phone-OTP sign-in you also add a Verify Service SID, and for sending you can add a phone number.
- The Account SID and fallback Auth Token are in the Twilio Console. Create Restricted API Keys in the console's API keys section. See the Twilio documentation and grant only the permission named in the connector setup guide.
- The Verify Service SID lives under Verify in the console, on the service you create for your app.
Open the project build, select Connectors, choose Twilio, and enter these values. The connection applies only to that project and requires a paid plan.
Saved secrets show as dots - the value never comes back to browser JavaScript. Use Test now to re-check the credentials against Twilio and Disconnect to remove them from the project.
Keys and security
Twilio Auth Tokens and API-key secrets are server secrets. A credential with sending permission can spend on your account, so it can never be bundled into an app people download. The connection test is non-mutating and proves authentication only; it does not prove that the credential can send SMS, use Verify, or access WhatsApp. The generated app must call a separately deployed server-side relay. Give that relay a different Restricted API Key with only its actual Messaging and/or Verify operations. Connecting Twilio neither deploys the relay nor transfers the saved credential.
Managed connector secrets are encrypted at rest with AES-256-GCM. Browser JavaScript sees only that a secret exists (the dots), the model prompt never receives the decrypted value, and the agent will never ask you for a key in chat.
Useful links
- Twilio documentation: https://www.twilio.com/docs
- Appsanic guide: SMS and phone verification
Next
Read SMS and phone verification for the full walkthrough of phone-OTP sign-in and sending messages.