Integrate Twilio for SMS, Voice, and Verification

This skill covers building communication features with Twilio across five patterns: SMS sending (E.164 phone validation, 160-character segmentation, delivery status callbacks, and specific error-code handling for opted-out recipients (21610), invalid numbers, unreachable phones (30003), and rate limits (30429)); Twilio Verify for 2FA/OTP (multi-channel SMS/voice/email/WhatsApp verification with Twilio-managed code generation and fraud prevention, plus a voice-fallback pattern when SMS delivery fails); TwiML-based IVR systems (the <Say>/<Gather>/<Dial>/<Record>/<Redirect> verbs, a full Flask webhook example routing callers to sales/support/voicemail with transcription callbacks); WhatsApp Business API messaging (the 24-hour session-reply window, pre-approved template messages required outside that window, and a Redis-backed session tracker); and webhook handling for delivery status, incoming messages, and call events, always gated behind Twilio's X-Twilio-Signature validation.

Its most operationally valuable content is a set of severity-rated "sharp edges" with concrete fixes: sending to opted-out numbers (error 21610, legally required under TCPA/CTIA - track opt-out status and never override it), transient phone-unreachable errors (30003, retry with backoff or fall back to email), silent carrier filtering of US SMS (register A2P 10DLC, avoid spam-trigger phrasing, monitor delivery rate), unvalidated webhook signatures (a critical security hole allowing spoofed callbacks), WhatsApp's 24-hour window violation (error 63016, requires session tracking and templates), exposed Account SID/Auth Token (use scoped API Keys instead of the full-access Auth Token, rotate immediately if leaked), and Verify's built-in rate limit (error 60203, add a stricter application-level limiter with clear user feedback). It also includes exponential-backoff retry decorators and a semaphore-based bulk-sending pattern to stay under Twilio's 80 messages-per-second default.

Use this skill for SMS notifications and transactional messages, phone verification/2FA, IVR phone menus and automated calling, WhatsApp Business messaging, and any Twilio webhook integration. It delegates adjacent concerns: AI voice conversation logic to voice-agents (Twilio provides only the telephony layer), Slack-integrated alerting to slack-bot-builder, broader authentication systems beyond phone verification to auth-specialist, workflow-triggered messaging to workflow-automation, and webhook scaling/monitoring to devops.

Input is a communication requirement - send an SMS, verify a phone number, build an IVR menu, send a WhatsApp message, or process an incoming webhook. Output is working Python code (using the twilio SDK and Flask) with E.164 validation, proper error-code handling, signature validation, and rate-limit-aware retry logic already built in.

pip install twilio

Built on the Twilio Python SDK (twilio.rest.Client, twilio.twiml.voice_response, twilio.request_validator.RequestValidator), Twilio Verify for multi-channel 2FA, Twilio's WhatsApp Business API, and Flask for webhook endpoints. Composes with voice-agents, slack-bot-builder, auth-specialist, and workflow-automation for adjacent needs.

Developers building SMS, voice IVR, WhatsApp, or phone-verification features who need Twilio's compliance requirements (opt-out handling, A2P 10DLC, webhook signature validation) and error-recovery patterns built in from the start, not discovered after a production incident.