Twilio API requests

Learn how to authenticate your requests, what content type to use for API requests, and how the Twilio APIs handle webhooks. You'll also see examples of how to make requests to the Twilio APIs.

Ways to make requests to the Twilio APIs

There are several ways you can make an HTTP request to the Twilio API.

Make a raw HTTP request either in your code (for example, by using a module like got in NodeJS) or with a tool like Postman.
Use a Twilio Helper Library for your preferred programming language.
Use the Twilio CLI if you prefer working in the terminal.

Authentication

(information)

Environment variables

Always store your credentials in environment variables before sharing any code or deploying to production. Learn more about setting environment variables.

To authenticate requests to the Twilio APIs, Twilio supports HTTP Basic authentication. You can use the following credentials:

Username	Password	Best practice
API Key	API Key Secret	This is the recommended way to authenticate with the Twilio APIs. When a key is compromised or no longer used, revoke it to prevent unauthorized access.
Account SID	AuthToken	Limit your use to local testing.

(information)

Regional API credentials

Twilio API credentials are region-specific resources. If your account uses Twilio Regions, see Manage Regional API credentials.

Using API keys (recommended)

An API key is a unique identifier that allows a client to access your Twilio account and create, read, update, or delete resources through the Twilio APIs. You can create multiple API keys for different purposes, such as for different developers or subsystems within your application. If a key is compromised or no longer used, you can revoke it to prevent unauthorized access.

You can create an API key either in the Twilio Console or using the API.

The API key types are Main, Standard, and Restricted (Public Beta, Key resource v1 only). The following table describes each type:

Key type	Access permissions	Create in Console	Create with REST API
Main	Full access to all Twilio API resources. Equivalent to using your Account SID and Auth Token for API requests.	Yes	No
Standard	Access to all Twilio API resources, except for Accounts (`/Accounts`) or Keys (`/Accounts/{SID}/Keys`, `/v1/Keys`) resources.	Yes	Yes
Restricted	Customized, fine-grained access to specific Twilio API resources. Learn more about Restricted API keys.	Yes	Yes (v1 only)

When making an API request, use your API key as the username and your API key secret as the password.

Note: In the following example, you must use a Main API key.

1curl -G https://api.twilio.com/2010-04-01/Accounts \
2  -u $YOUR_API_KEY:$YOUR_API_KEY_SECRET

The user remains logged in for the duration of the request. Learn more about how Twilio handles authentication.

Using your Account SID and Auth Token

Twilio recommends using only API keys for production applications. If a bad actor gains access to your Account SID and Auth Token, then your Twilio Account is compromised.

For local testing, you can use your Account SID as the username and your Auth token as the password. You can find your Account SID and Auth Token in the Twilio Console, under the Account Dashboard.

1curl -G https://api.twilio.com/2010-04-01/Accounts \
2  -u $YOUR_ACCOUNT_SID:$YOUR_AUTH_TOKEN

Twilio helper libraries

A Twilio helper library is a server-side SDK that helps you use Twilio's REST APIs, generate TwiML, and perform other common server-side programming tasks. All Twilio helper libraries come with a Utilities class that validates requests by passing your credentials to the library.

HTTP Methods

The Twilio APIs are RESTful and use standard HTTP methods to interact with resources. The following are the most common methods:

POST: Create or update a resource.
GET: Retrieve a resource.
DELETE: Delete a resource.

POSTGET: List messagesGET: Retrieve a messageDELETE

POST a new SMS message

1// Download the helper library from https://www.twilio.com/docs/node/install
2const twilio = require("twilio"); // Or, for ESM: import twilio from "twilio";
3
4// Find your Account SID at twilio.com/console
5// Provision API Keys at twilio.com/console/runtime/api-keys
6// and set the environment variables. See http://twil.io/secure
7const accountSid = process.env.TWILIO_ACCOUNT_SID;
8const apiKey = process.env.TWILIO_API_KEY;
9const apiSecret = process.env.TWILIO_API_SECRET;
10const client = twilio(apiKey, apiSecret, { accountSid: accountSid });
11
12async function createMessage() {
13  const message = await client.messages.create({
14    body: "Hello",
15    from: "+14155552344",
16    to: "+15558675310",
17  });
18
19  console.log(message.body);
20}
21
22createMessage();

Response

Note: This shows the raw API response from Twilio. Responses from SDKs (Java, Python, etc.) may look a little different.

1{
2  "account_sid": "ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
3  "api_version": "2010-04-01",
4  "body": "Hello",
5  "date_created": "Thu, 24 Aug 2023 05:01:45 +0000",
6  "date_sent": "Thu, 24 Aug 2023 05:01:45 +0000",
7  "date_updated": "Thu, 24 Aug 2023 05:01:45 +0000",
8  "direction": "outbound-api",
9  "error_code": null,
10  "error_message": null,
11  "from": "+14155552344",
12  "num_media": "0",
13  "num_segments": "1",
14  "price": null,
15  "price_unit": null,
16  "messaging_service_sid": "MGaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
17  "sid": "SMaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
18  "status": "queued",
19  "subresource_uris": {
20    "media": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/SMaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Media.json"
21  },
22  "to": "+15558675310",
23  "uri": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/SMaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.json"
24}

GET a list of message

1// Download the helper library from https://www.twilio.com/docs/node/install
2const twilio = require("twilio"); // Or, for ESM: import twilio from "twilio";
3
4// Find your Account SID at twilio.com/console
5// Provision API Keys at twilio.com/console/runtime/api-keys
6// and set the environment variables. See http://twil.io/secure
7const accountSid = process.env.TWILIO_ACCOUNT_SID;
8const apiKey = process.env.TWILIO_API_KEY;
9const apiSecret = process.env.TWILIO_API_SECRET;
10const client = twilio(apiKey, apiSecret, { accountSid: accountSid });
11
12async function listMessage() {
13  const messages = await client.messages.list({ limit: 20 });
14
15  messages.forEach((m) => console.log(m.body));
16}
17
18listMessage();

Response

Note: This shows the raw API response from Twilio. Responses from SDKs (Java, Python, etc.) may look a little different.

1{
2  "end": 1,
3  "first_page_uri": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages.json?To=%2B123456789&From=%2B987654321&DateSent%3E=2008-01-02&PageSize=2&Page=0",
4  "next_page_uri": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages.json?To=%2B123456789&From=%2B987654321&DateSent%3E=2008-01-02&PageSize=2&Page=1&PageToken=PAMMc26223853f8c46b4ab7dfaa6abba0a26",
5  "page": 0,
6  "page_size": 2,
7  "previous_page_uri": null,
8  "messages": [
9    {
10      "account_sid": "ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
11      "api_version": "2010-04-01",
12      "body": "testing",
13      "date_created": "Fri, 24 May 2019 17:44:46 +0000",
14      "date_sent": "Fri, 24 May 2019 17:44:50 +0000",
15      "date_updated": "Fri, 24 May 2019 17:44:50 +0000",
16      "direction": "outbound-api",
17      "error_code": null,
18      "error_message": null,
19      "from": "+12019235161",
20      "messaging_service_sid": "MGaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
21      "num_media": "0",
22      "num_segments": "1",
23      "price": "-0.00750",
24      "price_unit": "USD",
25      "sid": "SMded05904ccb347238880ca9264e8fe1c",
26      "status": "sent",
27      "subresource_uris": {
28        "media": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/SMded05904ccb347238880ca9264e8fe1c/Media.json",
29        "feedback": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/SMded05904ccb347238880ca9264e8fe1c/Feedback.json"
30      },
31      "to": "+18182008801",
32      "uri": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/SMded05904ccb347238880ca9264e8fe1c.json"
33    },
34    {
35      "account_sid": "ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
36      "api_version": "2010-04-01",
37      "body": "look mom I have media!",
38      "date_created": "Fri, 24 May 2019 17:44:46 +0000",
39      "date_sent": "Fri, 24 May 2019 17:44:49 +0000",
40      "date_updated": "Fri, 24 May 2019 17:44:49 +0000",
41      "direction": "inbound",
42      "error_code": 30004,
43      "error_message": "Message blocked",
44      "from": "+12019235161",
45      "messaging_service_sid": "MGaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
46      "num_media": "3",
47      "num_segments": "1",
48      "price": "-0.00750",
49      "price_unit": "USD",
50      "sid": "MMc26223853f8c46b4ab7dfaa6abba0a26",
51      "status": "received",
52      "subresource_uris": {
53        "media": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/MMc26223853f8c46b4ab7dfaa6abba0a26/Media.json",
54        "feedback": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/MMc26223853f8c46b4ab7dfaa6abba0a26/Feedback.json"
55      },
56      "to": "+18182008801",
57      "uri": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/MMc26223853f8c46b4ab7dfaa6abba0a26.json"
58    }
59  ],
60  "start": 0,
61  "uri": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages.json?To=%2B123456789&From=%2B987654321&DateSent%3E=2008-01-02&PageSize=2&Page=0"
62}

GET a specific message

1// Download the helper library from https://www.twilio.com/docs/node/install
2const twilio = require("twilio"); // Or, for ESM: import twilio from "twilio";
3
4// Find your Account SID at twilio.com/console
5// Provision API Keys at twilio.com/console/runtime/api-keys
6// and set the environment variables. See http://twil.io/secure
7const accountSid = process.env.TWILIO_ACCOUNT_SID;
8const apiKey = process.env.TWILIO_API_KEY;
9const apiSecret = process.env.TWILIO_API_SECRET;
10const client = twilio(apiKey, apiSecret, { accountSid: accountSid });
11
12async function fetchMessage() {
13  const message = await client
14    .messages("SMaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
15    .fetch();
16
17  console.log(message.body);
18}
19
20fetchMessage();

Response

Note: This shows the raw API response from Twilio. Responses from SDKs (Java, Python, etc.) may look a little different.

1{
2  "account_sid": "ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
3  "api_version": "2010-04-01",
4  "body": "testing",
5  "date_created": "Fri, 24 May 2019 17:18:27 +0000",
6  "date_sent": "Fri, 24 May 2019 17:18:28 +0000",
7  "date_updated": "Fri, 24 May 2019 17:18:28 +0000",
8  "direction": "outbound-api",
9  "error_code": 30007,
10  "error_message": "Carrier violation",
11  "from": "+12019235161",
12  "messaging_service_sid": "MGaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
13  "num_media": "0",
14  "num_segments": "1",
15  "price": "-0.00750",
16  "price_unit": "USD",
17  "sid": "SMaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
18  "status": "sent",
19  "subresource_uris": {
20    "media": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/SMb7c0a2ce80504485a6f653a7110836f5/Media.json",
21    "feedback": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/SMb7c0a2ce80504485a6f653a7110836f5/Feedback.json"
22  },
23  "to": "+18182008801",
24  "uri": "/2010-04-01/Accounts/ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/Messages/SMb7c0a2ce80504485a6f653a7110836f5.json"
25}

DELETE a message

1// Download the helper library from https://www.twilio.com/docs/node/install
2const twilio = require("twilio"); // Or, for ESM: import twilio from "twilio";
3
4// Find your Account SID at twilio.com/console
5// Provision API Keys at twilio.com/console/runtime/api-keys
6// and set the environment variables. See http://twil.io/secure
7const accountSid = process.env.TWILIO_ACCOUNT_SID;
8const apiKey = process.env.TWILIO_API_KEY;
9const apiSecret = process.env.TWILIO_API_SECRET;
10const client = twilio(apiKey, apiSecret, { accountSid: accountSid });
11
12async function deleteMessage() {
13  await client.messages("SMaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa").remove();
14}
15
16deleteMessage();

Content type

Twilio's APIs expect the API request content type to be application/x-www-form-urlencoded or multipart/form-data. Using an unsupported content type might cause unexpected behavior or errors.

Vanity URLs

Twilio doesn't support CNAMEs for unauthenticated access to HTTP Voice recording media URLs. Use HTTPS endpoints and Transport-Layer-Security (TLS) protocols when accessing voice recordings media files from your account. For more information, see the Changelog.

How the Twilio APIs handle webhooks

Webhooks are user-defined HTTP callbacks triggered by an event in a web application. Twilio uses webhooks to let your application know when events happen, like getting an incoming call or receiving an SMS message. Webhooks are triggered asynchronously.

When a webhook event occurs, Twilio makes an HTTP request, such as POST or GET, to the URL you configured for your webhook. Twilio's request to your application includes details of the event like the body of an incoming message or an incoming phone number. Your application can then process the event and reply to Twilio with a response containing the instructions you'd like Twilio to perform.

To handle a webhook when you use Twilio, you need to build a web application that can accept HTTP requests. Check out the Twilio Helper Libraries to get up and running quickly.