Product changelog and announcements

Between Thursday, November 19, 2026 and Monday, January 4 2027, Twilio will enter a Heightened Awareness Period (HAP) to help ensure reliable message delivery during peak traffic times, such as Black Friday and Cyber Monday. 

During this period, message sending rates to U.S. destinations will be monitored and may be limited at the account level for toll-free, short code, and 10DLC numbers.

Accounts that send high volumes of messages from short codes or toll-free numbers may be temporarily migrated to Market Throughput during the HAP. Customers will be notified via email if their account is affected. Market Throughput doesn’t affect 10DLC numbers, which will continue to live on Account Based Throughput.

For more information on how throughput limits may be impacted and what actions to take, customers can reach out to their Twilio account team.

 

We’re excited to announce that Twilio integration with Salesforce Service Cloud Voice now supports WhatsApp and SMS, alongside existing support for Voice and listed on the AppExchange.

This release comes with the following enhancements:

• Route SMS and WhatsApp conversations through Twilio TaskRouter into the Salesforce Omni-Channel widget, using the same presence, skills, and capacity model as voice
• Handle messaging conversations and voice calls concurrently in a single agent console, with agent presence synchronizing across all channels on work acceptance

To learn more about setup, please see the setup guide.

ElevenLabs voices are now available in Public Beta for <Say>, powered by the Flash v2 and Flash v2.5 models for fast, natural-sounding text-to-speech. Get started by specifying an ElevenLabs voice via the REST API or in a TwiML Bin.

Using the Webhook Configuration API, customers can configure how Twilio authenticates and delivers outbound webhooks, per URL. The API consists of two resources: Webhook Settings and Webhook Rules.

Webhook Settings hold the authentication and connection configuration. Customers can secure endpoints with OAuth 2.0. Twilio fetches an access token from the customer's authorization server using the client credentials flow and sends it as a Bearer token in the Authorization header of every webhook or with Shared Key signatures. Customers can also configure delivery behavior like timeouts and retries.

In Spain and France, an incoming call intended for a non-Spanish or non-French destination that is then forwarded internationally while presenting a Spanish or French domestic caller ID is now blocked, in line with local regulatory requirements.

Verify Custom Templates give you the flexibility and security to use custom SMS/RCS and Voice message templates beyond standard defaults or pre-approved options.

To learn more about how to create a custom template for your business needs, check out our support guide.

 

The Java Helper Library now handles unknown fields gracefully in nested response objects, but if customers are on an affected version, their integration is at risk until they upgrade.

Versions 10.0.0 through 12.1.1 parse nested response types (profile, configuration, webhook, and others) with strict deserialization. When an API response comes back with a field the SDK doesn't recognize, the request fails with ApiConnectionException: Unable to deserialize response: Unrecognized field. Because Twilio APIs can add new optional fields at any time, this is a latent break. Customers’ integrations work today and can start failing without warning the moment a new field ships.

In 13.0.0, the Java Helper Library ignores unknown fields in all response objects, matching how every other Twilio Helper Library already behaves.

What to do

Upgrade to Java Helper Library 13.0.0 or later as soon as possible. Version 13 does include breaking changes so follow the upgrade guide to migrate safely. Once customers are on 13.0.0, their integration handles new optional fields in API responses without hitting deserialization errors.

The Python, Node.js, C#, Ruby, PHP, and Go Helper Libraries are not affected. They already handle unknown response fields the same way.

 

Twilio SendGrid has added automatic SSL certificate provisioning as a toggle within the standard link branding setup flow. When enabled, SendGrid provisions and hosts the SSL certificate needed to serve tracking and branded links over HTTPS, removing the need to purchase, install, and maintain a certificate through an external CDN or DNS provider.

Twilio SendGrid recommends activating this setting for all link branding domains. Gmail is rolling out warnings on non-HTTPS links by the end of October 2026, and tracking links without SSL will see reduced click-through as a result. Enabling automatic SSL requires adding two additional DNS records provided by SendGrid, alongside the CNAME records already used for link branding.

The Link Branding API now supports a new auto_ssl parameter when creating a branded link. Setting auto_ssl to true provisions the certificate automatically, returns the additional DNS records needed to complete setup, and reports certificate status through a new auto_ssl_available field once the certificate is issued and live. auto_ssl can only be set when a link is created and can't be changed afterward.

 

Twilio has observed  a sudden rise in SMS Pumping fraud (aka SMS Artificially Inflated Traffic) targeting messages to Italy (IT) and Argentina (AR). To protect customers from this activity, Twilio Verify is tightening its fraud prevention posture for these two countries, effective August 19, 2026.

Specifically, Twilio is  updating the default Verify Geo Permissions setting for Italy and Argentina from "Allow all traffic" — the default state at account creation — to "Monitor all traffic for fraud." This change applies to all existing  accounts where IT and/or AR remain in  the default "Allow all traffic" state.

What this means for customers

• If your account still has IT and/or AR set to the default "Allow all traffic" permission, it will be updated to "Monitor all traffic for fraud" starting August 19, 2026.

• If you've already changed the geo permission for IT or AR away from the default “Allow all traffic” (to any other state), your configuration will not be modified by this update.

• The protection provided by "Monitor all traffic for fraud" requires that you have Fraud Guard enabled. 

• No action is required for customers with Fraud Guard enabled. This update happens automatically for in-scope accounts. Customers that revert the status back to “Allow all traffic” risk SMS Pumping fraud and are responsible for payment to all traffic to IT and AR.

• You can review or change your geo permissions at any time from the Verify Geo Permissions page in the Twilio Console.

Customers can now send Content Templates to many recipients at once and personalize the template for each recipient using the Bulk Messaging API. This update enhances and simplifies sending notifications and marketing messages campaigns. With Bulk Messaging's configurable fallback, this release also enables new fallback strategies including WhatsApp to SMS and RCS to WhatsApp. Read the tutorial to get started today!