Twilio Changelog | Dec. 10, 2025
Restricted API Keys is now in GA
Restricted API Keys is now Generally Available (GA). You can now enforce the principle of least privilege by assigning specific permissions to individual keys, ensuring they only access exactly what is needed.
By scoping keys to specific endpoints or resources, you minimize security risks and limit the potential impact of leaked credentials. You can create and manage Restricted API Keys in the Twilio Console or programmatically via APIs.
Customers will see a new type ‘Restricted’ when creating an API Key and can choose permissions for supported products like Messaging, Phone Numbers, Voice, Studio, Verify, TaskRouter, Lookup, Monitor, Event Streams and Usage.
API calls made with a Restricted API Key will only allow access to selected permissions. Calls made to resources that are not part of the selected permissions will be unauthorized.
Restricted API Keys is only available in the US region.
To learn more about Restricted API Keys, please check our docs.