REST API: Secondary Auth Token
Warning
If you are using Services or Functions(Classic) and have included your auth token directly instead of using a variable, you must wait for 1 minute for the update of your auth token to propagate. Otherwise, those functions and services will fail with a 403 Forbidden error.
Twilio uses the Account SID and Auth Token to authenticate API requests. The Auth Token can be rotated in the Console or with this API. There are two related endpoints, one to promote the secondary Auth Token and this one to create or delete the secondary Auth Token.
The SID of the Account that the secondary Auth Token was created for.
^AC[0-9a-fA-F]{32}$Min length: 34Max length: 34The date and time in UTC when the resource was created specified in ISO 8601 format.
The date and time in UTC when the resource was last updated specified in ISO 8601 format.
The generated secondary Auth Token that can be used to authenticate future API requests.
The URI for this resource, relative to https://accounts.twilio.com
POST https://accounts.twilio.com/v1/AuthTokens/Secondary
Rotating Auth Tokens for many subaccounts
Each Auth Token change sends email to every owner and administrator of the account. Rotating Auth Tokens across many subaccounts at once can generate a high volume of email, which can delay other messages that Twilio sends to the same recipients, such as Console verification codes.
We recommend setting SuppressEmailNotification to true when you rotate Auth Tokens for a large number of accounts, and telling your users about the rotation through your own channels.
application/x-www-form-urlencodedWhether to suppress the email notification that Twilio sends to the owners and administrators of the account about this Auth Token change. Defaults to false, so Twilio sends the email. Set to true when rotating Auth Tokens across many subaccounts.
1// Download the helper library from https://www.twilio.com/docs/node/install2const twilio = require("twilio"); // Or, for ESM: import twilio from "twilio";34// Find your Account SID and Auth Token at twilio.com/console5// and set the environment variables. See http://twil.io/secure6const accountSid = process.env.TWILIO_ACCOUNT_SID;7const authToken = process.env.TWILIO_AUTH_TOKEN;8const client = twilio(accountSid, authToken);910async function createSecondaryAuthToken() {11const secondaryAuthToken = await client.accounts.v112.secondaryAuthToken()13.create();1415console.log(secondaryAuthToken.accountSid);16}1718createSecondaryAuthToken();
Response
1{2"account_sid": "ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",3"date_created": "2015-07-31T04:00:00Z",4"date_updated": "2015-07-31T04:00:00Z",5"secondary_auth_token": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",6"url": "https://accounts.twilio.com/v1/AuthTokens/Secondary"7}
DELETE https://accounts.twilio.com/v1/AuthTokens/Secondary
Rotating Auth Tokens for many subaccounts
Each Auth Token change sends email to every owner and administrator of the account. Rotating Auth Tokens across many subaccounts at once can generate a high volume of email, which can delay other messages that Twilio sends to the same recipients, such as Console verification codes.
We recommend setting SuppressEmailNotification to true when you rotate Auth Tokens for a large number of accounts, and telling your users about the rotation through your own channels.
Whether to suppress the email notification that Twilio sends to the owners and administrators of the account about this Auth Token change. Defaults to false, so Twilio sends the email. Set to true when rotating Auth Tokens across many subaccounts.
1// Download the helper library from https://www.twilio.com/docs/node/install2const twilio = require("twilio"); // Or, for ESM: import twilio from "twilio";34// Find your Account SID and Auth Token at twilio.com/console5// and set the environment variables. See http://twil.io/secure6const accountSid = process.env.TWILIO_ACCOUNT_SID;7const authToken = process.env.TWILIO_AUTH_TOKEN;8const client = twilio(accountSid, authToken);910async function deleteSecondaryAuthToken() {11await client.accounts.v1.secondaryAuthToken().remove();12}1314deleteSecondaryAuthToken();