OAuth apps FAQs

What are the regions supported?

We currently support this feature only in the US1 region.

Are there any costs associated with using this feature?

OAuth apps are available to all accounts at no additional cost.

Which roles allow access to the OAuth apps feature?

Users with the Owner, Administrator, Developer or Account API Access Admin role can access account-level OAuth apps.

Users with the Organization Owner or Organization Admin role will be able to access Organization OAuth apps.

If I generate a new access token will the old token still work?

Yes. If a new access token is generated, the previous access token will continue to work until it expires.

What happens when a user who has created an OAuth app is deleted or removed from the account?

There will be no impact on the OAuth app and the credentials will still work.

What should I do if my credentials are compromised?

Immediately rotate the secret with the grace period set to 0, or delete the app. This invalidates the previous credentials and access tokens.

Is this feature also available for subaccounts? Will the account OAuth app work for Subaccount?

Yes, this feature is available for subaccounts. Account-level OAuth apps only work for the account they were created in, not for its subaccounts. Create a separate OAuth app for each subaccount that needs an account-level OAuth app.

What is the difference between Client Credentials and Authorization Code grant types?

Use the Client Credentials grant type for server-to-server interactions where no user is present (such as backend services or scheduled jobs). The application authenticates using only its Client ID and Client Secret.

Use the Authorization Code grant type when your application needs to access Twilio APIs on behalf of a specific user. The user signs in to Twilio and explicitly approves access, which makes this flow more secure for user-facing applications.

See the OAuth apps overview for full details on both grant types.

How long are access tokens and refresh tokens valid? What happens when they expire?

Access tokens are valid for the Token expiration time configured on your OAuth app (between 1 minute and 30 days, defaulting to 1 hour). Once an access token expires, API calls using it will return a 401 Unauthorized response.

To get a new access token, follow these steps:

For Client Credentials apps, send a new token request with your Client ID and Client Secret.
For Authorization Code apps, use the refresh token returned with the original access token to request a new one without prompting the user to re-authorize. See OAuth Token API for details.