Twilio auth token leaked? Roll it now — SMS fraud is fast

1. Step 01

   Twilio Console → Account → API keys & tokens → in the "Auth tokens" panel, click "Show" on the secondary, then "Promote secondary token".

2. Step 02

   Update your env vars to the new primary, then "Generate new secondary token".

3. Step 03

   Pull SMS logs for the last 24 hours. Look for outbound messages to premium-rate numbers (international codes you don’t serve).

Step 01 — Revoke

Kill the leaked credential first

Console → Account → API keys & tokens → "Live" tab → Auth tokens. The "Promote secondary" pattern lets you rotate without downtime: promote secondary → update env → generate new secondary.

Step 02 — Rotate

Update the new key in the right place

Server-side env vars only — never in client code, never with NEXT_PUBLIC_.

import twilio from 'twilio';
const client = twilio(
  process.env.TWILIO_ACCOUNT_SID!,
  process.env.TWILIO_AUTH_TOKEN!,  // never NEXT_PUBLIC_
);

Step 03 — Scan

Confirm nothing else leaked alongside it

Scan to find every messaging or telephony secret in your bundle.

How this usually leaks

• 01Used in a client component for browser-side SMS verification.
• 02Stored in a config file deployed publicly.
• 03.env committed to source control.