Skip to contentSkip to navigationSkip to topbar
Twilio Docs
Page tools
On this page
Looking for more inspiration?Visit the

OAuth apps

OAuth apps enable OAuth 2.0 authorization for Twilio APIs using the client credentials grant type defined in RFC 6749, section 4.4(link takes you to an external page). This grant type is designed for machine-to-machine (server-to-server) interactions, such as backend services, where an application authenticates directly with another application rather than on behalf of a user.

You can create OAuth apps directly in the Twilio Console. When you create an OAuth app, Twilio automatically generates a Client ID and Client Secret for that app. Next, use these credentials to request an access token from the Twilio OAuth token endpoint. After you obtain an access token, you can authenticate calls to Twilio APIs . The sequence diagram below illustrates this client credentials flow.

OAuth apps client credential sequence diagram

Here are the key benefits of using OAuth Apps:

  • Using OAuth credentials short lived access tokens are generated. Right now the expiry is fixed at 1 hr.
  • Access tokens are scoped and have restricted access to only some APIs.
(information)

Note

OAuth apps currently do not support the Authorization Code grant type, which is used for third-party delegated access scenarios. For third-party delegated access, use Twilio Connect instead.

Create an OAuth App

create-an-oauth-app page anchor
Twilio ConsoleLegacy Console
  1. Log in to Twilio Console(link takes you to an external page) and navigate Settings > Organization settings > Organization API access(link takes you to an external page).
  2. Click Create OAuth application.
  3. On the Application details page, select the grant type and enter the application details:
    • Application name
    • Application description
    • Company name
    • Images for the application
    • Homepage URL
    • Terms of service URL
    • Redirect URL
  4. On the Scopes & permissions page, select the scopes and permission you want to include in the OAuth application.
  5. On the Copy secret page, copy the credentials and store them somewhere secure.
  6. Select the Got it! checkbox and click Finish.

To generate the access token, use the Token API.

View or update an OAuth app

view-or-update-an-oauth-app page anchor
Twilio ConsoleLegacy Console
  1. Log in to Twilio Console(link takes you to an external page) and navigate to Settings > Organization settings > Organization API access(link takes you to an external page).
  2. Click on the OAuth app name you want to view or update.
    • To update the app details, on the Application details tab, click Edit application details and update the details, then click Save.
    • To update OAuth scopes, on the Access settings tab, update the scopes, then click Save.

Rotate Secret of an OAuth app

rotate-secret-of-an-oauth-app page anchor
Twilio ConsoleLegacy Console
  1. Log in to Twilio Console(link takes you to an external page) and navigate to Settings > Organization settings > Organization API access(link takes you to an external page).
  2. Click on the OAuth app name you want to rotate secret for.
  3. On the Credentials tab, click Rotate secret, then click Yes, rotate secret on the confirmation pop-up.
  4. Copy the new credentials and store them somewhere secure.
  5. Select the Got it! checkbox and click Done.
(information)

Note

When a secret is rotated, the old secret remains valid for 24 hours before becoming inactive.

Delete an OAuth App

delete-an-oauth-app page anchor
Twilio ConsoleLegacy Console
  1. Log in to Twilio Console(link takes you to an external page) and navigate to Settings > Organization settings > Organization API access(link takes you to an external page).
  2. In the Action column of the OAuth app you want to delete, click Delete.
  3. In the pop-up, click Delete.

OAuth apps Audit Events

oauth-apps-audit-events page anchor

Audit Events can be viewed from Twilio Console under Monitor-> Insights -> Audit(link takes you to an external page). There are 4 Audit Events related to OAuth apps:

  1. oauth-apps.created: This event is triggered when an oauth-app is created.
  2. oauth-apps.updated: This event is triggered every time an oauth-app is updated.
  3. oauth-apps.deleted: This event is triggered every time an oauth-app is deleted.
  4. oauth-apps.secret-rotated: This event is triggered every time the client secret of an OAuth app is rotated.

Scopes/Permissions available with OAuth apps

scopespermissions-available-with-oauth-apps page anchor
(warning)

Warning

An OAuth app has a limit of 100 scopes/permissions that can be associated with it.

Each permission maps to one or more endpoints/actions for each API Resource. To download a PDF of the permissions/endpoint actions, click one of the links below: