Twilio Credential Security: API Key Management and Best Practices

import os
from twilio.rest import Client

client = Client(
    os.environ["TWILIO_ACCOUNT_SID"],
    os.environ["TWILIO_AUTH_TOKEN"]
)

# Create a standard API key
def create_api_key(name, key_type="standard"):
    """Create a new API key.
    Types: standard (full access), restricted (scoped)
    """
    key = client.new_keys.create(
        friendly_name=name,
        key_type=key_type
    )
    print(f"Key SID: {key.sid}")
    print(f"Name: {key.friendly_name}")
    print(f"Type: {key.key_type}")
    print(f"Secret: {key.secret[:10]}...")  # Only shown once!
    print("SAVE THIS SECRET - it will not be shown again.")
    return key

# key = create_api_key("DodaTech SMS Service", "standard")
# Expected output:
# Key SID: SKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Name: DodaTech SMS Service
# Type: standard
# Secret: GSb3c4d5e...
# SAVE THIS SECRET - it will not be shown again.

# Create restricted API key with granular permissions
def create_restricted_key(name, permissions, subaccount_sid=None):
    """Create an API key restricted to specific services.

    permissions: list of allowed services
    Example: ["sms:send", "verify:create", "calls:make"]
    """
    params = {
        "friendly_name": name,
        "key_type": "restricted",
        "restricted_data_transfer": {
            "direction": "inbound,outbound"
        }
    }
    if subaccount_sid:
        params["subaccount_sid"] = subaccount_sid

    key = client.new_keys.create(**params)
    print(f"Restricted Key: {key.sid}")
    print(f"Name: {key.friendly_name}")
    print(f"Permissions: {permissions}")
    return key

# restricted_key = create_restricted_key(
#     "Verify Service Only",
#     ["verify:create", "verify:check"]
# )
# Expected output:
# Restricted Key: SKyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
# Name: Verify Service Only
# Permissions: ['verify:create', 'verify:check']

# Using restricted key instead of Auth Token
restricted_client = Client(
    os.environ["TWILIO_ACCOUNT_SID"],
    "GS_restricted_key_secret_here"
)

# Test restricted access
try:
    result = restricted_client.verify.v2.services("VAxxx").verifications.create(
        to="+14155551234",
        channel="sms"
    )
    print(f"Verify API works: {result.sid}")
except Exception as e:
    print(f"Verify API error: {e}")

# Create a subaccount for development
def create_subaccount(name):
    subaccount = client.api.accounts.create(
        friendly_name=name
    )
    print(f"Subaccount SID: {subaccount.sid}")
    print(f"Name: {subaccount.friendly_name}")
    print(f"Status: {subaccount.status}")
    return subaccount

# dev_acct = create_subaccount("DodaTech Dev")
# Expected output:
# Subaccount SID: ACyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
# Name: DodaTech Dev
# Status: active

# Create API key for subaccount
def create_subaccount_key(subaccount_sid, name):
    """Create a key that operates only within the given subaccount."""
    subaccount_client = Client(
        subaccount_sid,
        os.environ["TWILIO_AUTH_TOKEN"]
    )
    key = subaccount_client.new_keys.create(
        friendly_name=name
    )
    print(f"Subaccount Key: {key.sid}")
    print(f"Scope: {subaccount_sid}")
    return key

# List all subaccounts
def list_subaccounts():
    accounts = client.api.accounts.list()
    print("All accounts:")
    for acct in accounts:
        print(f"  {acct.friendly_name}: {acct.sid[:20]}... ({acct.status})")
    return accounts

# list_subaccounts()
# Expected output:
# All accounts:
#   DodaTech Main: ACxxxxxxxxxxxxxxxx... (active)
#   DodaTech Dev: ACyyyyyyyyyyyyyyyy... (active)

import schedule
import time

def rotate_credentials():
    """Rotate API keys: create new, switch apps, delete old."""
    print(f"[{time.ctime()}] Starting credential rotation...")

    # 1. Create new key
    new_key = client.new_keys.create(
        friendly_name=f"DodaTech SMS {time.strftime('%Y-%m')}"
    )
    print(f"  Created: {new_key.sid}")

    # 2. In production, deploy new key to environment
    # (This is handled by your CI/CD system)
    print(f"  Deploy new key secret to production")

    # 3. After confirming new key works, delete old key
    old_key_sid = "SK_old_key_to_delete"
    try:
        client.new_keys(old_key_sid).delete()
        print(f"  Deleted old key: {old_key_sid}")
    except Exception as e:
        print(f"  Could not delete old key: {e}")

    print("  Rotation complete.")
    return new_key

# Schedule monthly rotation
# schedule.every().month.do(rotate_credentials)

# rotate_credentials()
# Expected output:
# [Mon Jun 28 10:00:00 2026] Starting credential rotation...
#   Created: SKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
#   Deploy new key secret to production
#   Deleted old key: SK_old_key_to_delete
#   Rotation complete.

def check_unauthorized_activity(hours_back=24):
    """Check for suspicious API activity."""
    from datetime import datetime, timedelta
    start_time = datetime.utcnow() - timedelta(hours=hours_back)

    # Check for failed auth attempts
    events = client.monitor.events.list(
        start_date=start_time,
        level="ERROR",
        limit=50
    )

    suspicious = []
    for event in events:
        if event.description and "authentication" in event.description.lower():
            suspicious.append(event)
            print(f"SUSPICIOUS: {event.date_created}")
            print(f"  {event.description}")
            print(f"  SID: {event.sid}")
            print()

    print(f"Found {len(suspicious)} suspicious events in {hours_back}h")
    return suspicious

# check_unauthorized_activity()
# Expected output:
# Found 0 suspicious events in 24h

# Check API key usage
def list_api_keys_and_usage():
    keys = client.new_keys.list()
    print(f"Active API keys: {len(keys)}")
    for k in keys:
        print(f"  {k.friendly_name}: {k.sid[:20]}... ({k.date_created})")
        print(f"    Type: {k.key_type}")
    return keys