Integration · Channels
Twilio integration for AI voice agents and SMS
We use Twilio to give an AI voice agent a phone number, route calls, stream audio to the agent and send SMS follow-ups. Every build opens with an AI disclosure and a recording-consent step, and every call has a path to a person.
Twilio
Channels
Access
Authentication and least-privilege scopes
A revocable Twilio API key for REST calls, and signature validation on every webhook
- subaccount per environment
- voice: one number set
- messaging: one service
- webhooks: signed requests only
Webhook signatures use the account auth token, so it stays in a secrets manager and never reaches app code. Numbers, subaccounts and recordings stay in your Twilio account.
Objects
What we read and what we write
Incoming phone number
Read: YesWrite: No
Points its voice and messaging webhooks at your service.
Call + status callbacks
Read: YesWrite: Yes
Answered, transferred, completed; callbacks drive the call log.
TwiML response
Read: NoWrite: Yes
Tells Twilio what to do next: say, gather, stream or dial a person.
Media Stream (WebSocket)
Read: YesWrite: Yes
Live audio both ways between the call and the voice agent.
Recording
Read: YesWrite: Yes
Only after consent; deleted through the API on your retention schedule.
Message (SMS)
Read: YesWrite: Yes
Confirmations and follow-ups; replies return as webhooks.
Data flow
System of record and write-back
Twilio carries the call and the messages, and your CRM or booking system keeps the records. The voice agent runs in your service between the two.
- The caller dials your Twilio number, and Twilio asks your webhook what to do.
- The agent’s first words say it is an AI, and it asks for consent before any recording.
- Audio streams to the agent, which answers, books or looks things up through your systems’ APIs.
- A transfer dials a person with a short summary; the outcome and transcript are written back.
- Caller
- Inbound SMS
- Booking system
- Person on call
- Call log + transcript
Worked example
Twilio in a build
Sample workflows
What teams build with Twilio
Pattern 01
After-hours answering
The agent answers when the office is closed, takes a message or books the next free slot, and flags anything urgent to the person on call.
Pattern 02
Missed-call recovery
When a call is missed, an SMS offers a callback or a booking link where the caller’s consent allows it, and the reply is logged against the caller in your CRM.
Pattern 03
Reminders with confirm or reschedule
Reminder texts take a reply keyword to confirm, cancel or reschedule, and the booking system updates directly.
Failure handling
What breaks, and what the build does about it
Your webhook is slow or unreachable
Voice requests have a hard time cap, so the first reply is short TwiML and slow work runs after it. A fallback URL plays a message and takes a voicemail if the service is down.
The agent cannot help the caller
After repeated failed turns, or as soon as the caller asks, the call transfers to a person with a summary.
Nobody answers the transfer
The call drops to voicemail, the caller gets an SMS, and the team gets an alert with the transcript.
Fit · Twilio
When it is the wrong choice
- Most calls need a person from start to finish, such as complaints or complex sales. Good call routing may be all you need.
- Recording consent cannot be collected in your market or channel. Run the agent without recording, or keep calls with people.
- You need US texting at volume but cannot register for A2P 10DLC. Unregistered traffic is filtered more and costs more.
Alternatives worth pricing
Customers who would rather message than call.
The full scope: scripts, testing, latency budget and escalation design.
Your current phone system
If it can forward calls to a SIP endpoint, the agent can sit behind it without a new number.
Where it is used
Related use cases, services and guides
Limits
Limits and common errors
Twilio signs every request with the X-Twilio-Signature header (HMAC-SHA1 with your auth token). Validate it with the SDK and the exact URL Twilio called; Twilio advises against writing your own validator.
Source: Webhooks security (opens in a new tab) · Twilio Docs · accessed
Webhook defaults: 5 s to connect, 15 s to read, 15 s total and one retry on connection failure. Call-related requests have a hard 15-second cap.
Source: Webhooks connection overrides (opens in a new tab) · Twilio Docs · accessed
A unidirectional stream (<Start><Stream>) only receives audio. A bidirectional stream (<Connect><Stream>) can play audio back and blocks later TwiML until the WebSocket closes.
Source: Media Streams (opens in a new tab) · Twilio Docs · accessed
Recordings can be deleted through the API, but their metadata is kept for 40 days. Twilio notes that recording laws can require consent and recommends asking your counsel.
Source: Recording resource (opens in a new tab) · Twilio Docs · accessed
Anyone sending application SMS to the US from a 10-digit long code must register a brand and a campaign; unregistered traffic carries extra carrier fees.
Source: A2P 10DLC (opens in a new tab) · Twilio Docs · accessed
Security
Security notes
- Every webhook is validated against its X-Twilio-Signature header before it is handled.
- Recording starts only after a spoken yes, and transcripts mask card numbers before they are stored.
- Test and production run in separate subaccounts with separate numbers.
FAQ
Frequently asked questions
Do callers have to be told they are talking to an AI?
We always say so in the agent’s first sentence and offer a person on request. Some markets require it by law; we do it everywhere because callers deserve to know who they are talking to.
Can we keep our existing business number with Twilio?
Often, yes. Many numbers can be ported to Twilio, or your current provider can forward calls to a Twilio number. Porting rules differ by country and carrier, so we check your number before planning the switch.
Is call recording allowed for an AI receptionist?
It depends on where you and your callers are, and some places require every party’s consent. Our default is to ask at the start, record only after a yes, and have your counsel confirm the wording for your markets.
Why use media streams rather than simple speech prompts?
Prompt-and-gather steps wait for the caller to finish and then reply, which suits menus. A bidirectional media stream carries live audio both ways, so the agent can listen, answer and be interrupted the way people talk.
Do SMS follow-ups to US numbers need A2P 10DLC registration?
Yes, when they come from a standard local number. Brand and campaign registration is required, and unregistered traffic is filtered more and charged extra. We prepare the registration details with you during the build.
Next step
Have a workflow in mind? Let’s scope it together.
Book a free 30-minute strategy call. Bring one process you want to automate and we will talk through scope, integrations and a sensible first step.
Free 30-minute call · no commitment