Production checklist
Twilio production checklist: 4 checks before launch
4 checks for running Twilio in production: 4 should-dos. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (4)
Validate the X-Twilio-Signature on webhooks
Stops forged SMS/call callbacks.
Check the code
The webhook handler validates X-Twilio-Signature (validateRequest, or the webhook() middleware) and returns 403 when it fails. An unsigned POST to the URL should get 403.
twilio.validateRequest(authToken, signature, url, params);
Use API keys in your app, not the account Auth Token
API keys can be revoked one at a time; the Auth Token controls the whole account.
Check the config
The app authenticates with an API key SID (starts with SK) and secret, and the Auth Token isn’t deployed.
const client = twilio(process.env.TWILIO_API_KEY, process.env.TWILIO_API_SECRET, { accountSid: process.env.TWILIO_ACCOUNT_SID });Allow SMS only to the countries you serve
SMS pumping fraud sends your one-time codes to premium numbers abroad and bills you for them.
How to verify
In the Twilio Console under Messaging → Settings → Geo permissions, only the countries you serve are ticked.
Rate-limit verification codes per phone number and IP
Bots request codes in bulk to run up your bill.
Verify from the command line
Request codes for one number several times quickly; your app should refuse after its limit.
for i in $(seq 1 8); do curl -s -o /dev/null -w "%{http_code} " -X POST https://<your-app>/api/send-code -d "phone=<number>"; done
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.