Twilio Changelog

As we previously communicated, starting March 3, 2025, Twilio will rotate the end-user certificate and will update the list of supported cipher suites in all Twilio REST APIs. 

End-user Certificate Rotation

Only the end-user certificate will be renewed, as well as the certificate serial number. The root and intermediate certificates will remain the same. Such updates are common practice and do not impact customers that are using Twilio's services unless you are pinning certificates or are managing them manually. Customers using the official Twilio Helper Libraries should not experience any impact as they are designed to handle certificate rotations.

We highly discourage customers from pinning certificates as it exposes them to potential security risks and can cause downtimes for their services. Twilio customers using pinned certificates have a high probability of failed API Requests. These customers are advised to add the new certificates by March 3, 2025. 

Updates on the Cipher List

All our REST API endpoints will only support the cipher suites listed below. Support for any other cipher suite will be removed from that time:

Supported TLSv1.3 ciphers

• TLS_AES_128_GCM_SHA256

• TLS_AES_256_GCM_SHA384

• TLS_CHACHA20_POLY1305_SHA256

Supported ECDSA ciphers (TLSv1.2)

• ECDHE-ECDSA-AES128-GCM-SHA256

• ECDHE-ECDSA-AES128-SHA256

• ECDHE-ECDSA-AES256-GCM-SHA384

• ECDHE-ECDSA-CHACHA20-POLY1305

• ECDHE-ECDSA-AES256-SHA384

Supported RSA ciphers (TLSv1.2)

• ECDHE-RSA-AES128-GCM-SHA256

• ECDHE-RSA-AES128-SHA256

• ECDHE-RSA-AES256-GCM-SHA384

• ECDHE-RSA-CHACHA20-POLY1305

• ECDHE-RSA-AES256-SHA384

Customers are advised to check that their infrastructure supports at least one of these cipher suites. Customers running older operating systems or legacy network software may need to upgrade their systems to be compatible with these changes.

Test your configuration

The new security configuration is now available on the testing domain ( https://tls-test.twilio.com ). 

For more information on how to test the updated cipher list, we advise you to read https://help.twilio.com/articles/226478767-Monitoring-Updates-to-Twilio-REST-API-Security-Settings

You can now select permissions for Verify APIs while creating a Restricted API Key. The product already supports permissions for Messaging, Phone Numbers, Studio, Voice, Task Router, Monitor and Lookup APIs.

Restricted API Keys allow you to decide which Twilio API Resources an API Key can access, and which action(s) the API Key is allowed to take on those API Resources.

Twilio previously sent email communications that we plan to end of life (EOL) the WhatsApp Templates page in console at the end of Q1'2025. Customers will need migrate to Content Templates and change the way the way they send templates to use Content Sid and Content Variables instead of using the body parameter.

To further inform customers, from February 12, 2025 onwards, Twilio will start to publish warnings (63052) when customers use the Legacy WhatsApp Templates product to send templates. Templates sent will continue to be delivered until April 1, 2025 but the template matching logic using body will no longer work after that.

To learn more about the EOL process as a whole and how to migrate, please see this support article here.

Flex administrator pages that manage your Flex UI version (“Versions”) and turn on opt-in Flex features (“Features”) are migrating from Flex UI’s Administrator section into Flex Console. This continues the journey toward a unified Flex administrator experience in Flex Console. It also prevents administrators from being charged for logging in to Flex UI for administrative tasks.

These pages will remain available in parallel in Flex UI > Administrator until March 4, but we encourage Flex administrators to make sure they can access the pages in Flex Console ahead of this transition. You can find the pages in their new locations in Console:

• Flex > Manage > UI versions

• Flex > Manage > Opt-in features

If you experience any issues accessing these pages in Console, contact Twilio support as soon as possible.

Twilio is announcing the end of life (EOL) for outdated versions of the Sync and Chat SDKs. Starting on March 31, 2025, the following SDK versions will no longer be supported, and critical features such as live updates and chat functionality will stop working:

Sync SDK:

• Javaccript: Versions below 0.8.1

• iOS: Versions below 0.8.1

• Android: Versions below 0.8.0

Chat SDK:

• Javascript: Versions below 3.0.0

• iOS: Versions below 2.4.2

• Android: Versions below 4.0.0

SDKs that are not updated by the EOL date may fail to connect to Twilio services and could return errors such as 404 “HOST_NOT_FOUND.”

This change allows Twilio to focus on delivering faster troubleshooting, better guidance when issues arise, enhanced security, and improved performance for applications using supported SDK versions. Upgrading ensures your applications benefit from these improvements and remain operational.

What Do You Need to Do?

To avoid service disruptions, please complete the following steps before March 31, 2025:

1. Upgrade to the Minimum Supported Versions:

   • Sync SDK: Javascript 0.8.1, iOS 0.8.1, Android 0.8.0

   • Chat SDK: Javascript 3.0.0, iOS 2.4.2, Android 4.0.0

2. Test Your Updates:

   • Test your upgrades in a safe environment to ensure everything works as expected before deploying changes live.

For more information on how we support our SDKs, see our SDK version and support documentation, and consider upgrading to the latest versions.

You can now subscribe to Conversations post-action events through Event Streams. Event Streams enables you to:  

• Stream your data to your existing systems by configuring a modern, persistent streaming technology like Amazon Kinesis, webhooks, or Segment. 

• Consume data from multiple Twilio products with consistent metadata, well-defined and versioned schemas, and control over which events you want delivered.

• Trust that your events will be queued if your system goes down and delivered as soon as it's back up, with event queuing for up to 4 hours.

Event Streams is the recommended way to consume Conversations events for analytics and monitoring use cases. See the list of available events in the Event Streams documentation.

In February the display name in Console, invoices, order forms, and the Usage API for Programmable Voice conferences mixed in Ashburn (us1) and Umatilla (us2) will be updated to remove specific reference to US East. 

This is an enhancement for Twilio Verify customers requesting that a One-Time Password (OTP) message be sent via WhatsApp. We continuously monitor the availability of the WhatsApp channel, and will now automatically send your OTP message via SMS as a fallback in the event of an outage, degradation, destination country/region unavailability, or missing/misconfigured WhatsApp Sender. This fallback will only occur if you have enabled the SMS channel and the message will be billed as if you had requested an SMS in the first place. This fallback will be enabled on April 24, 2025 for all customers by default, but you can opt-out here at anytime. For more details, refer to the documentation here.

Any direct customers who do not already have access to WhatsApp Self Sign-up can now upgrade directly within the Twilio Console. This enables: 

• Faster onboarding register additional WhatsApp Senders in under 5 minutes—including Bring-Your-Own-Number (BYON) WhatsApp Senders (e.g., non-Twilio numbers).

• Access to Meta-provided insights within the Meta WhatsApp Business Manager.

• Ability to add your WhatsApp Sender as the Contact Button to a Facebook page or Instagram account.

• Meta advertising with Click to Whatsapp Ads.

• Self service ability to directly apply for a WhatsApp Official Business Account (blue checkmark) with Meta.

Twilio now offers rich messaging on RCS through the Content Template Builder. You can now create and send rich cards, media, and rich card carousels. Twilio will support more rich RCS functionality in the near future.

When you send a rich content message through Messaging Services, Twilio will automatically deliver RCS rich content to compatible devices. For devices that do not support RCS , Twilio will send the defined fallback via SMS or MMS. You can define a twilio/media or twilio/text type as a fallback within your rich content template. To learn more about how to create and send rich content on RCS see our docs here. If you want to learn more about RCS generally and request access, you can do so here.