# Ekx Twilio

> SMS, WhatsApp, voice and OTP verification with Twilio — the official skills and MCP server, how it compares to the Meta Graph API we already use for WhatsApp, and the compliance work Colombian and US messaging actually requires. Use when a product needs SMS, phone verification, voice, or a second WhatsApp path. NOT YET IN PRODUCTION anywhere — read the "before you adopt" section first.

- Skill: `ekinoxis-evm/ekx-twilio` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ekinoxis-evm/ekx-twilio`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ekinoxis-evm/ekx-twilio/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: Ekinoxis-evm (https://skillmd.com/u/ekinoxis-evm)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/ekinoxis-evm/ekx-twilio

---


# Twilio

> ⚠️ **Not used in any Ekinoxis project.** Audited every `package.json`, `.env.example` and
> source file on 2026-08-28: **zero integration.** This skill exists so that adopting Twilio
> is a decision with the trade-offs written down, not a default.

## What we do today instead

| Need | What we actually run |
|---|---|
| WhatsApp | **Meta Graph API** directly — [`ekx-meta-ads`](../ekx-meta-ads/SKILL.md), plus a WhatsApp sales agent running on n8n |
| Transactional email | **Resend** — [`ekx-resend`](../ekx-resend/SKILL.md), 4 projects |
| Auth / identity | **Privy** (email OTP, social, wallet) — [`ekx-privy`](../ekx-privy/SKILL.md), 5 projects. **Supabase Auth** email OTP elsewhere |
| SMS | **nothing** |
| Voice | **nothing** |

**SMS and voice are the genuine gaps.** Everything else Twilio sells, we already have a
working answer for.

## Before you adopt

Ask in this order:

1. **Is it really SMS you need, or just a one-time code?** Supabase Auth and Privy both do
   email OTP today, in production, at no extra vendor. Our commerce stack uses passwordless
   email OTP and has never needed SMS.
2. **Is it WhatsApp?** We already send WhatsApp through Meta's Graph API. Twilio would be a
   *second* path to the same channel — more surface, another bill, another set of template
   approvals.
3. **Is it voice, or SMS to a Colombian mobile?** Then yes — Twilio, or a local aggregator.
   Nothing we own covers that.

If the answer is (3), continue. Otherwise stop.

## Official skills and MCP

Twilio ships both, in **Public Beta** — expect changes.

```bash
claude plugin install twilio-developer-kit      # Claude Code
npx skills add twilio/ai                        # skills CLI
```

**56 skills**, vendored at [`../../vendor/twilio/`](../../vendor/twilio/SOURCE.md) — far
more than their docs page advertises. The ones that matter for a first integration:

| Category | Skills |
|---|---|
| **Setup** | `twilio-account-setup` · `twilio-iam-auth-setup` · `twilio-numbers-senders` · `twilio-webhook-architecture` |
| **Send** | `twilio-sms-send-message` · `twilio-whatsapp-send-message` · `twilio-verify-send-otp` · `twilio-sendgrid-email-send` |
| **Choose** | `twilio-identity-verification-advisor` · `twilio-notifications-alerts-advisor` · `twilio-messaging-channel-advisor` · `twilio-voice-ai-agent-advisor` |
| **Compliance** | `twilio-compliance-onboarding` · `twilio-compliance-traffic` · `twilio-security-hardening` · `twilio-regulatory-compliance-bundles` |

MCP server — live OpenAPI specs across 1,800+ endpoints:

```json
"twilio-docs": { "type": "http", "url": "https://mcp.twilio.com/docs" }
```

Start with an **advisor** skill, not a send skill. Twilio has several products that all
send a message and the advisors exist because picking wrong is expensive — `Verify` is the
right answer for OTP, not raw SMS, because it handles retries, fraud scoring and carrier
rules you would otherwise rebuild.

## The part that is not code

Messaging is a **compliance product**, and this is where the real cost sits:

- **US A2P 10DLC registration** — brand and campaign registration before you can send to US
  numbers at any volume. Days to weeks, not minutes. `twilio-compliance-onboarding`.
- **WhatsApp templates** need Meta approval — the same approval flow we already deal with
  on the Graph API. Twilio does not remove it.
- **Colombia** — SMS to Colombian mobiles goes through local aggregators with their own
  rules. Verify the route before promising a delivery rate.
- **Never send an OTP and a marketing message from the same sender.** Traffic mixing is the
  fastest way to get a number filtered. `twilio-compliance-traffic`.

## Env vars, when the time comes

```
TWILIO_ACCOUNT_SID=
TWILIO_AUTH_TOKEN=        # or an API key pair — prefer keys, they're revocable
TWILIO_VERIFY_SERVICE_SID= # if using Verify
TWILIO_MESSAGING_SERVICE_SID=
```

Server-only. Rotate through API keys rather than the account auth token so a leak is
revocable without taking down every integration.

## Webhooks

Twilio signs with `X-Twilio-Signature`. Verify it with the SDK's validator on every inbound
request, and **fail closed when the token is unset** — the same rule as MercadoPago in
[`ekx-mercadopago`](../ekx-mercadopago/SKILL.md). `twilio-webhook-architecture` covers the
retry and ordering semantics; assume deliveries repeat and arrive out of order, and make the
handler idempotent.

## See also

[`ekx-meta-ads`](../ekx-meta-ads/SKILL.md) — WhatsApp as we send it today ·
[`ekx-resend`](../ekx-resend/SKILL.md) — email ·
[`ekx-privy`](../ekx-privy/SKILL.md) — OTP without a messaging vendor