Exposed Twilio API Key / Auth Token? Here's how to detect and rotate it

Twilio requests are authorized with either your Account SID plus Auth Token, or an API Key (SID starting with SK) and its secret. Both can send SMS, make calls, and read your logs, all billed to your account. If either leaks, an attacker can rack up charges and pull your data until you rotate it in the Console.

What an attacker can do with a leaked Twilio API Key / Auth Token

• Sends SMS and places voice calls on your account, and toll fraud to premium international numbers can cost thousands fast.
• Reads your message and call logs — phone numbers, message bodies, and recordings — leaking your users' data.
• Buys phone numbers and changes messaging config, entrenching access and adding more to your bill.
• Drains your balance and can get your account flagged or suspended for the fraudulent traffic.

How Twilio API Key / Auth Tokens get exposed

• Committed to a public repo — the Account SID and Auth Token pair often sit together in a .env.
• Hardcoded in a mobile app or client-side bundle instead of staying on your server.
• Pasted into a screenshot, support ticket, or chat while debugging SMS or voice.
• Logged in plaintext in server logs or an HTTP request trace.

How to rotate a leaked Twilio API Key / Auth Token

1. Sign in at console.twilio.com and open Account → Keys & Credentials → API keys & tokens.
2. If the Auth Token leaked, create a Secondary Auth Token, update your app to use it, then click ‘Promote to Primary’ — this deletes the old token and rejects it immediately.
3. If an API Key (SK…) leaked, open it under API keys, click ‘Delete this API Key,’ and confirm — requests using it stop working at once.
4. Create a fresh API Key if you deleted one, copy its secret once, and store it in your secrets manager.
5. Update your server environment with the new credential and redeploy, then remove the Account SID + Auth Token from anywhere it was hardcoded.
6. Check Monitor → Logs → Messaging and Voice, plus Usage, for SMS, calls, or number purchases you didn't make, and open a Twilio support ticket if you see fraud.

Open the Twilio API Key / Auth Token dashboard →