Additional API security features

Most advanced security measures require:

• Twilio Security Edition or Twilio Enterprise Edition
• Twilio security team review and approval
• Configuration and deployment planning
• Coordination with Twilio support

Public Key Client Validation (PKCV) replaces traditional shared credentials, such as Auth Tokens, with asymmetric cryptography. Eligible Twilio Security Edition and Twilio Enterprise Edition customers can access PKCV.

PKCV offers superior protection compared to shared secrets. Its private key never leaves your infrastructure and can't be intercepted or leaked from Twilio systems. Twilio only stores the public key. It can't be used to sign requests.

To authenticate API requests, PKCV uses asymmetric cryptography. To implement PKCV, follow this process:

1. Generate a public key pair in your infrastructure.
2. Register the public key with Twilio.
3. Keep the private key secure in your own infrastructure.
4. Sign each API request cryptographically with the private key.
5. Include the signature with the request (signature covers URL, headers, and body).
6. Twilio verifies the request using the registered public key.

Once PKCV is enabled for an account, standard REST API requests can't use Auth Tokens. Before enabling PKCV, plan and document:

• Key generation and storage procedures
• Key rotation and expiration policies
• Key revocation procedures
• Key recovery procedures for disaster scenarios
• App deployment impact and downtime requirements
• Rollback procedures if issues arise

Twilio Interconnect provides a private, dedicated network connection between customer infrastructure (such as a data center or virtual private cloud) and Twilio's edge network.

By establishing a private network link, Interconnect reduces your API traffic's exposure to the following issues:

• Public internet routing and interception
• Domain Name System (DNS) spoofing or hijacking attacks
• Man-in-the-middle (MITM) attacks at the network layer
• Visibility of your traffic to external observers

Interconnect helps you with strict data residency, compliance, or regulatory requirements.

Private connectivity serves as one layer of defense. It doesn't eliminate the need for other security controls. Implement the following additional security measures:

• App-layer authentication and authorization
• Encryption at the app layer
• Secrets management and credential protection
• Endpoint security and input validation
• Request signature validation and webhook verification

A layered defense strategy includes Twilio Interconnect. Interconnect doesn't replace other security measures.

To maintain platform stability and help protect against runaway abuse, Twilio enforces account concurrency limits. Abuse includes SMS pumping and account takeover scenarios.

Concurrency limits act as a circuit breaker that restricts the speed and volume of API requests from your account. By limiting simultaneous API requests, concurrency controls can:

• Reduce the speed and scale of unexpected activity while automated detection systems respond.
• Protect your account from abuse during the detection window.
• Reduce or prevent fraudulent charges in SMS pumping scenarios.
• Create detectable patterns that trigger alerts from security monitoring.

While detection and response systems engage, concurrency limits can reduce abuse impact. To protect your account, implement multiple layers:

• App-level rate limiting on sensitive endpoints
• Asynchronous queueing with backoff for retries
• Real-time spend and usage alerting
• Anomaly detection and alerting on unusual patterns
• Credential rotation and secrets management
• Monitoring of failed authentication attempts
• Rapid incident response procedures

Strengthen your API security posture:

• Secure authentication: OAuth 2.0 and API key best practices
• Defense-in-depth strategy: comprehensive security layers
• Secrets management: protecting credentials and keys
• Incident response: responding to compromised accounts
• Twilio Security documentation