Store Your Twilio Credentials Securely

It's important to keep credentials such as your Twilio Account SID and Auth token secure by storing them in a way that prevents unauthorized access. One common method is to store them in environment variables which are then accessed from your app. This keeps them out of code and other places where credentials don't belong. Let's take a look at how to work with environment variables with a variety of operating systems and languages.

Set environment variables

From the command line, set environment variables to contain your credentials. For example:

TWILIO_ACCOUNT_SID
TWILIO_AUTH_TOKEN

(warning)

Warning

If you store these in a .env file so they persist across reboots, make sure to tell Git to ignore the .env file by adding *.env to your .gitignore file. You do not want your credentials uploaded in plain text to the Git repository.

Mac & Linux

Add your credentials as environment variables in a twilio.env file and source them:

1echo "export TWILIO_ACCOUNT_SID='ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'" > twilio.env
2echo "export TWILIO_AUTH_TOKEN='your_auth_token'" >> twilio.env
3source ./twilio.env

Make sure that Git ignores the twilio.env file:

echo "twilio.env" >> .gitignore

Windows

You can store your credentials in environment variables via the command line. You will have to do this at the start of each command-line session (each time you run cmd.exe or PowerShell).

Windows command line (cmd.exe)

1set TWILIO_ACCOUNT_SID=ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2set TWILIO_AUTH_TOKEN=your_auth_token

PowerShell

1$Env:TWILIO_ACCOUNT_SID="ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
2$Env:TWILIO_AUTH_TOKEN="your_auth_token"

To make the Windows environment variables permanent, see How to Set Environment Variables.

Cloud providers

Most cloud providers give you a way to securely configure environment variables for your application.

Load credentials from environment variables

Once you have stored your credentials in environment variables, they are accessible by name to your apps. Always access your credentials using the variable names and never hard-code credentials in your code. Choose your language to see the right code for you.

Load credentials from environment variables

1// Download the Node helper library from twilio.com/docs/node/install
2// These are your accountSid and authToken from https://www.twilio.com/console
3// To set up environmental variables, see http://twil.io/secure
4const accountSid = process.env.TWILIO_ACCOUNT_SID;
5const authToken = process.env.TWILIO_AUTH_TOKEN;
6
7const client = require('twilio')(accountSid, authToken);
8
9// Make API calls here...