--- "@context": https://schema.org "@type": TechArticle "@id": https://www.twilio.com/docs/usage/api-security-reference-guide/additional-features#article headline: Additional API security features description: Learn about additional Twilio API security features, including Public Key Client Validation, Twilio Interconnect, and concurrency limits. url: https://www.twilio.com/docs/usage/api-security-reference-guide/additional-features inLanguage: en dateModified: 2026-10-30T15:44:40.000Z author: "@type": Organization name: Twilio Developer Education Team publisher: "@type": Organization name: Twilio --- # Additional API security features Twilio provides advanced security features for you with elevated security requirements or specialized use cases. These features complement your defense-in-depth strategy and might be available based on your account type and [Twilio Edition][editions]. ## Prerequisites for additional measures Most advanced security measures require: * Twilio Security Edition or Twilio Enterprise Edition * Twilio security team review and approval * Configuration and deployment planning * Coordination with Twilio support ## Public Key Client Validation [*Public Key Client Validation* (PKCV)][pkcv] replaces traditional shared credentials, such as Auth Tokens, with asymmetric cryptography. Eligible Twilio Security Edition and Twilio Enterprise Edition customers can access PKCV. ### Why PKCV matters PKCV offers superior protection compared to shared secrets. Its private key never leaves your infrastructure and can't be intercepted or leaked from Twilio systems. Twilio only stores the public key. It can't be used to sign requests. ### How PKCV works To authenticate API requests, PKCV uses [asymmetric cryptography][]. To implement PKCV, follow this process: 1. Generate a public key pair in your infrastructure. 2. Register the public key with Twilio. 3. Keep the private key secure in your own infrastructure. 4. Sign each API request cryptographically with the private key. 5. Include the signature with the request (signature covers URL, headers, and body). 6. Twilio verifies the request using the registered public key. ### Important considerations before enabling PKCV Once PKCV is enabled for an account, standard REST API requests can't use Auth Tokens. Before enabling PKCV, plan and document: * Key generation and storage procedures * Key rotation and expiration policies * Key revocation procedures * Key recovery procedures for disaster scenarios * App deployment impact and downtime requirements * Rollback procedures if issues arise ## Twilio Interconnect [Twilio Interconnect][] provides a private, dedicated network connection between customer infrastructure (such as a data center or virtual private cloud) and Twilio's edge network. ### Benefits of private connectivity By establishing a private network link, Interconnect reduces your API traffic's exposure to the following issues: * Public internet routing and interception * [*Domain Name System* (DNS)][dns] spoofing or hijacking attacks * *Man-in-the-middle* (MITM) attacks at the network layer * Visibility of your traffic to external observers Interconnect helps you with strict data residency, compliance, or regulatory requirements. ### Interconnect supplements app security Private connectivity serves as one layer of defense. It doesn't eliminate the need for other security controls. Implement the following additional security measures: * App-layer authentication and authorization * Encryption at the app layer * Secrets management and credential protection * Endpoint security and input validation * Request signature validation and webhook verification A [layered defense strategy][Defense-in-depth strategy] includes Twilio Interconnect. Interconnect doesn't replace other security measures. ## Concurrency limits To maintain platform stability and help protect against runaway abuse, Twilio enforces account [concurrency limits][]. Abuse includes SMS pumping and account takeover scenarios. ### How concurrency limits protect your account Concurrency limits act as a circuit breaker that restricts the speed and volume of API requests from your account. By limiting simultaneous API requests, concurrency controls can: * Reduce the speed and scale of unexpected activity while automated detection systems respond. * Protect your account from abuse during the detection window. * Reduce or prevent fraudulent charges in SMS pumping scenarios. * Create detectable patterns that trigger alerts from security monitoring. ### Don't rely only on concurrency limits While detection and response systems engage, concurrency limits can reduce abuse impact. To protect your account, implement multiple layers: * App-level rate limiting on sensitive endpoints * Asynchronous queueing with backoff for retries * Real-time spend and usage alerting * Anomaly detection and alerting on unusual patterns * Credential rotation and secrets management * Monitoring of failed authentication attempts * Rapid incident response procedures ## Next steps Strengthen your API security posture: * [Secure authentication][]: OAuth 2.0 and API key best practices * [Defense-in-depth strategy][]: comprehensive security layers * [Secrets management][]: protecting credentials and keys * [Incident response][]: responding to compromised accounts * [Twilio Security documentation][] [asymmetric cryptography]: https://en.wikipedia.org/wiki/Public-key_cryptography [concurrency limits]: /docs/usage/rest-api-best-practices [Defense-in-depth strategy]: /docs/usage/api-security-reference-guide/defense-in-depth-strategy [editions]: /docs/iam/twilio-editions [dns]: /docs/glossary/dns [Incident response]: /docs/usage/api-security-reference-guide/incident-response [pkcv]: /docs/iam/pkcv [Secrets management]: /docs/usage/api-security-reference-guide/secrets-management [Secure authentication]: /docs/usage/api-security-reference-guide/secure-auth [Twilio Interconnect]: /docs/voice/api/sip-interconnect [Twilio Security documentation]: /docs/iam