Securing Twilio API Credentials on Mobile Devices

A Twilio Auth Token can place calls and send SMS on your account, so it should not sit in a shared database or in a support email.

1. On-device storage

ReachTo does not ask you to send the Auth Token to a ReachTo server. On Android, the credentials you enter are stored on the device with EncryptedSharedPreferences. The iOS app is coming soon; that version is planned to use the device Keychain. ReachTo does not ask for your Twilio Console password.

2. Calls go to Twilio

Signaling and media for a call are between the phone and Twilio over encrypted TLS and SRTP. ReachTo is the client. Twilio remains the carrier for the number.

3. You can revoke the token

Create the Auth Token in the Twilio Console and rotate or revoke it there if you stop using a device. ReachTo support will not ask you to email that token or your Twilio password.

Questions about this guide

Where does ReachTo store my Twilio Auth Token?

On the Android device, using EncryptedSharedPreferences. ReachTo does not store the token on a ReachTo server. The iOS app is coming soon.

Will ReachTo ask for my Twilio Console password?

No. ReachTo asks for the Account SID and Auth Token that you create in the Twilio Console. You can rotate that token in Twilio without giving ReachTo your login password.