AbsoluteJS

@absolutejs/auth-twilio

@absolutejs/auth-twiliov0.3.0betaAuth & Identity

Twilio Verify provider for @absolutejs/auth MFA challenges.

#Installation

BASH
bun add @absolutejs/auth-twilio

#Capabilities

Overview

Twilio Verify implementation of the auth/verification-provider contract from @absolutejs/auth. Twilio owns OTP generation, delivery, fraud evaluation, and verification status; Absolute Auth owns enrollment, MFA policy, and session promotion.

This is intentionally separate from @absolutejs/dispatch-twilio, which sends application-authored alerts through Programmable Messaging.

Usage

Optional per-purpose templates keep enrollment and login copy distinct:

The adapter supports SMS, WhatsApp, and voice-call OTP channels, locale, rate-limit buckets, and tenant-to-account/Verify-Service routing. Twilio's Fraud Guard risk check is enabled only for SMS, the channel Twilio supports it on. By default tags contain only the purpose; buildTags is an explicit opt-in and should never return direct personal data. Unknown Verify statuses fail closed.

Boundaries

@absolutejs/auth enforces enrollment state, resend cooldown, failed-attempt

policy, audit events, and session promotion.

Twilio Verify generates and checks the code and applies service-level fraud

Show 4 more

and rate-limit policy.

The configured serviceTokenTtlMs is an application assertion because

Twilio's start response does not expose the service token lifetime.

Prefer Twilio API keys in production when constructing the SDK client.

Outcomes

What you can build

Build on the supported package contract

Use @absolutejs/auth-twilio through its supported public entry points.

Hardening checklist

Production guidance

Make every external boundary explicitPin the deployed @absolutejs/auth-twilio version, replace example or memory-backed dependencies with durable implementations, bound external calls, protect credentials, and emit enough evidence to retry or recover safely.

Follow in order

Troubleshooting path

1
Trace from the first failed boundary
Reproduce the smallest canonical @absolutejs/auth-twilio example, confirm the supported entry point and version in the API explorer, then inspect the first boundary that did not produce its documented result.

#Usage

Partial snippet

Working example for Usage.

TS
import { auth } from "@absolutejs/auth";
import { createTwilioVerificationProvider } from "@absolutejs/auth-twilio";
import { Twilio } from "twilio";

const client = new Twilio(
  process.env.TWILIO_ACCOUNT_SID!,
  process.env.TWILIO_AUTH_TOKEN!,
);

const authPlugin = await auth({
  // credentials, mfa, stores, providersConfiguration, etc.
  verificationProvider: createTwilioVerificationProvider({
    profile: {
      client,
      verifyServiceSid: process.env.TWILIO_VERIFY_SERVICE_SID!,
    },
    // Must match the token lifetime configured on the Verify Service.
    serviceTokenTtlMs: 10 * 60 * 1000,
  }),
});

#Usage 2

Partial snippet

Optional per-purpose templates keep enrollment and login copy distinct:

TS
createTwilioVerificationProvider({
  profile: { client, verifyServiceSid },
  serviceTokenTtlMs: 600_000,
  templates: {
    mfa_enrollment: { sms: "HJ...", whatsapp: "HJ..." },
    mfa_challenge: { call: "HJ...", sms: "HJ..." },
  },
});

#Public entry points

Supported entry points declared by this package manifest.

Package entry point declared in package.json.

@absolutejs/auth-twilio@absolutejs/auth-twilio/manifest@absolutejs/auth-twilio/manifest.json

#Package commands

Scripts declared by this package manifest.

bun run buildrm -rf dist && bun build src/index.ts src/manifest.ts --outdir dist --sourcemap --target=bun --external @absolutejs/auth --external '@absolutejs/auth/*' --external twilio --external 'twilio/*' --external @absolutejs/manifest --external @sinclair/typebox && tsc --project tsconfig.build.json && absolute-manifest emit
bun run check:packagebun run format && bun run typecheck && bun run test && bun run verify-package && bun run build && bun run verify-package --artifacts
bun run formatprettier --write "./**/*.{ts,json,md}"
bun run testbun test
bun run typechecktsc --noEmit

#API reference

Search the declarations exported by the current package type files. Expand a symbol to inspect its source-backed signature.

6 symbols
TwilioVerifyClientLiketypePermalinkSource
TS
type TwilioVerifyClientLike = {
    verify: {
        v2: {
            services: (serviceSid: string) => {
                verificationChecks: {
                    create: (input: {
                        code: string;
                        verificationSid: string;
                    }) => Promise<{
                        sid?: string;
                        status: TwilioVerificationStatus | string;
                    }>;
                };
                verifications: {
                    (verificationSid: string): {
                        update: (input: {
                            status: "canceled";
                        }) => Promise<unknown>;
                    };
                    create: (input: {
                        channel: VerificationChannel;
                        locale?: string;
                        rateLimits?: Record<string, string>;
                        riskCheck?: "enable";
                        tags: string;
                        templateSid?: string;
                        to: string;
                    }) => Promise<{
                        sid?: string;
                        status: TwilioVerificationStatus | string;
Exported from @absolutejs/auth-twilio