Secure Your Twilio API Key in Node.js

The Problem

This is what most Node.js codebases look like today. The TWILIO_AUTH_TOKEN key (SK...) lives directly in the process environment. If your repo, your CI logs, or your deployment config leaks — so does your key.

// sms.js — real Twilio credentials in environment
import twilio from "twilio";

const client = twilio(
  process.env.TWILIO_ACCOUNT_SID,  // ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  process.env.TWILIO_AUTH_TOKEN,   // your_auth_token
);

export async function sendSms(to, body) {
  const message = await client.messages.create({
    from: "+15555550100",
    to,
    body,
  });
  return message.sid;
}

The Fix

Send the request to the KeyVault Edge proxy at https://proxy.keyvaultedge.com with the provider's usual path, your kvt_ token in X-KV-Token and the provider's base URL in X-KV-Target. The proxy refuses requests whose Origin isn't on the token's allowed hosts, then injects your real TWILIO_AUTH_TOKEN, so it never sits in your app's environment.

// sms.js — KVE_TOKEN is host-bound; Twilio credentials not in process
export async function sendSms(to, body) {
  const response = await fetch(`https://proxy.keyvaultedge.com/2010-04-01/Accounts/${process.env.TWILIO_ACCOUNT_SID}/Messages.json`, {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded", // Twilio uses form bodies
      "X-KV-Token": process.env.KVE_TOKEN, // kvt_... token, server-side only
      "X-KV-Target": "https://api.twilio.com",
      // Must match one of the token's allowed hosts
      Origin: process.env.APP_ORIGIN,
    },
    body: new URLSearchParams({
      From: "+15555550100",
      To: to,
      Body: body,
    }),
  });

  const data = await response.json();
  return data.sid;
}

Setup in 4 steps

# .env
TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
KVE_TOKEN=kvt_...your_token
APP_ORIGIN=https://yourdomain.com  # one of the token's allowed hosts

What this protects, and what it doesn't

• Your real TWILIO_AUTH_TOKEN stays at the edge, so it can't leak from your repo, logs, bundle or server environment.
• The kvt_ token is still a credential. A copied token can be replayed by anyone who can send the right headers, including a fake Origin from a server. The protection is that each token has its own rate limits, monthly cost cap and endpoint scope, and you can revoke it in one click without rotating the provider key.
• The cost cap is estimated from the usage the provider reports, so a request already in flight can overshoot it slightly.

Plans and limits are on the pricing page.

More Twilio guides