Twilio
D REST API
No federation: the best you get is an OAuth client-credentials flow (public beta) that still starts from a client secret, or API keys that never expire. Twilio itself is a good citizen about scoping and secret scanning. Sending recordings to your S3 bucket means handing it an IAM user's access key.
Docs: twilio.com · Checked 2026-09-16 · source YAML · dispute via PR
Inbound C
How a workload running anywhere authenticates to this product.
OAuth 2.0 client-credentials grant (public beta) exchanges a Console-issued Client ID and Client Secret for short-lived access tokens; otherwise a static API Key SID + Secret or the Account SID + Auth Token.
- twilio.com checked 2026-09-16
“We support the Client Credentials grant type of OAuth 2.0 as defined in RFC 6749, section 4.4.”
- twilio.com checked 2026-09-16
“Twilio generates a Client ID and Client Secret”
- twilio.com checked 2026-09-16
“OAuth credentials generate tokens with a limited lifespan, reducing the risk of credential leaks.”
- twilio.com checked 2026-09-16
“API keys are the preferred way to authenticate with Twilio's REST APIs.”
No OIDC or cloud-identity federation of any kind was found in the IAM docs. Public Key Client Validation (a customer-held private key that signs requests) is the other "no shared secret" option and is equally C-grade: a static private key with no federation. OAuth for Twilio APIs was announced as public beta on 2025-11-06; the overview page carries no status label. Access-token lifetime is not stated in the docs fetched.
Outbound D
How this product reaches into your cloud, repos, or other SaaS.
External S3 storage for Voice and Video recordings takes an IAM user's access key ID and secret access key, stored as a Twilio CredentialAWS resource; Twilio publishes a deny-everything-except-s3:PutObject IAM policy but no rotation guidance.
- twilio.com checked 2026-09-16
“An AWS IAM user with permission to write objects to that bucket. You'll need the IAM user's access key ID and secret access key.”
- twilio.com checked 2026-09-16
“Twilio can store video and voice recordings on AWS Simple Storage Service (S3). To access S3, Twilio uses AWS credentials.”
- twilio.com checked 2026-09-16
“The AWS credentials: The access key ID and secret access key for an AWS Identity and Access Management (IAM) user with write access to the bucket.”
This is the only place the core REST API reaches into a customer cloud that we found; Segment, SendGrid and Flex are separate products. The Video tutorial's example policy denies everything except s3:PutObject on a single prefix, which is real least-privilege guidance, so this is D rather than F. No IAM-role/external-ID option exists for the core recording integration (Segment's S3 destination has one; not graded here). The CredentialAWS resource can be updated by API, but the docs do not explain a rotation procedure.
Hygiene for any static credential the product still issues
| ✗ Expiry enforceable | The documented Key resource properties are only sid, friendly_name, date_created, date_updated and secret. No expiry field on the Key resource and no expiration option in the Console creation flow. Keys live until deleted.
|
| ✓ Rotation via API | Create and DELETE endpoints exist on both the v2010 Keys resource and the v1 Keys resource.
|
| ✓ Scoped keys | Restricted API keys went GA on 2025-12-10 (public beta since 2024-02-14). Main and Standard keys are all-or-nearly-all access.
|
| ✗ Last-used visible | The Key resource exposes only sid, friendly_name, date_created, date_updated and secret. Neither the Key resource nor the Console docs expose a last-used timestamp. Graded conservatively; if Twilio shows one somewhere undocumented, send a receipt.
|
| ✓ Leak revocation | Partner pattern for API keys and Account String Identifiers; also push-protected.
|
Notes
Headline is D because of the outbound surface; the inbound API alone would be C. Twilio moves to B or A only if it accepts OIDC tokens (GitHub Actions, cloud identities, or a custom issuer) for its token endpoint.
Badge
[](https://wif.tax/p/twilio-api/)