Twilio

Twilio is how your app reaches a phone number directly: a text message, a one-time passcode for sign-in, or a WhatsApp message. Connect it once and the agent can build phone-OTP sign-in, send transactional or notification SMS, and message customers over WhatsApp - all from a plain prompt, with the secret credentials kept off the device.

What you get by connecting it

With Twilio connected, the agent can:

• Sign people in by phone number. It wires the one-time-passcode flow on top of Twilio Verify - the user enters their number, receives a code, and types it back in. Verify generates, sends, and checks the codes for you, so the app never has to store or compare them.
• Send SMS. Order confirmations, alerts, reminders, and other transactional or notification messages, sent from your Twilio number or messaging service.
• Message over WhatsApp. Reach customers on WhatsApp using the same account, for the conversations where that fits better than a text.

Every one of these calls runs through a small server-side relay so the Auth Token stays on the server.

Connecting it

Twilio needs an Account SID (it starts with AC) and an Auth Token. For phone-OTP sign-in you also add a Verify Service SID, and for sending you can add a phone number.

• The Account SID and Auth Token are on the main dashboard of the Twilio Console. See the Twilio documentation if you need a hand finding them.
• The Verify Service SID lives under Verify in the console, on the service you create for your app.

Paste these into Dashboard then Connectors then Twilio. Connect once and every project in your account can use it. Connecting requires a paid plan.

Saved secrets show as dots - the value never comes back to the browser. The connector page has a Test connection control to re-check the credentials against Twilio, and a Disconnect control to remove them.

Keys and security

The Twilio Auth Token is a secret key: anyone holding it can send messages and spend on your account, so it can never be bundled into an app people download. Twilio is therefore a secret-key-plus-relay connector. The generated app calls Twilio through a small server-side relay that holds the token in its own environment, and with Supabase connected the agent can deploy that relay for you as a Supabase Edge Function.

Managed connector secrets are encrypted at rest with AES-256-GCM. The browser only ever sees that a secret exists (the dots), never its value, the AI never sees a decrypted secret, and the agent will never ask you for a key in chat.

Useful links

• Twilio documentation: https://www.twilio.com/docs
• Appsanic guide: SMS and phone verification

Next

Read SMS and phone verification for the full walkthrough of phone-OTP sign-in and sending messages.