Twilio
Reliable enough to answer the phone, slow enough to register early
We run Twilio in four production systems. Voice and WhatsApp for ZhoopZhoop. Voice, WhatsApp, and SMS for Broollie. SMS reminders for Lexpair and Maidily. This is what maintaining them has taught us.
The short answer
Twilio is the right default for programmable voice and business messaging, provided you start A2P 10DLC registration weeks before launch and verify every inbound webhook against its signature.
Choose differently in two cases. A voice-only product that wants AI turn-taking handled for you is less work on a dedicated voice AI platform than on Twilio directly. A product sending only low volumes of SMS runs fine on a simpler SMS-only provider, with fewer moving parts.
What decides this
4 things that decide this
- 01A2P 10DLC brand and campaign registration for US SMS is a carrier review, not an API call, and it can take days to weeks depending on the use case.
- 02Every inbound webhook must be verified with the X-Twilio-Signature header, or anyone who finds the URL can post fake call and message events into your system.
- 03Programmable Voice and the WhatsApp Business API cover the two channels most service businesses actually need, on one account and one billing relationship.
- 04Cost tracks usage directly: per-minute voice, per-message SMS and WhatsApp, so volume forecasting matters more here than the sticker price.
A programmable layer over the phone network and WhatsApp
Twilio gives you an API for phone calls, SMS, and WhatsApp Business messaging, all from application code instead of carrier contracts. Programmable Voice streams call audio to your servers over WebSockets. That is what lets a speech-to-text engine and a language model sit inside a live call.
The detail that matters commercially is that Twilio does not do the AI. It routes the audio and the messages. The speech recognition, turn-taking, and reasoning come from services you plug in. That makes it a routing layer you build a voice agent on top of, not a voice agent product itself.
What holds up and what does not
Strengths
- One account covers voice, SMS, and WhatsApp, so a system like Broollie can send the same reminder by voice, WhatsApp, or SMS without a second vendor relationship.
- Programmable Voice streams live call audio over WebSockets, which is what let us put Deepgram and OpenAI in the middle of a real customer call for ZhoopZhoop.
- The WhatsApp Business API is the same integration surface as SMS and voice, so a booking assistant built for one channel reuses most of its logic on another.
- Delivery and call status land as webhooks, so a dashboard can show a call, quote, or reminder the moment it happens rather than on a polling delay.
Trade-offs
- A2P 10DLC registration is a carrier-side review of your brand and use case, not an instant API step. Building the launch timeline as if messaging goes live the day the account does causes real slippage.
- Twilio's webhooks are unauthenticated by default. Verifying the X-Twilio-Signature header is the only thing standing between your call and booking endpoints and someone who has simply found the URL.
- WhatsApp template messages need pre-approval before you can send anything outside a 24-hour customer service window, which changes how a reminder flow has to be designed, not just when it fires.
- Cost is metered per minute and per message with no flat tier, so a support decision like adding a confirmation call back has a direct and immediate line to the bill.
- Webhook URL sharedPosted in docs, a ticket, or a log line
- No signature checkEndpoint trusts anything shaped right
- Forged event postedFake call or message record accepted
- Silent bad dataNo error, just a record that should not exist
Every failure of this kind we have seen was a missing signature check, not a platform fault. Twilio signs every webhook request; the integration has to verify it.
What we use it for, and what each one taught us
ZhoopZhoop runs Twilio Programmable Voice for inbound customer calls and outbound supplier calls, plus the WhatsApp Business API for chat bookings. It is a multi-branch auto repair business. Call audio streams through Twilio to Deepgram for speech, then to OpenAI for the reasoning that books an appointment or compares a parts quote. Broollie uses all three channels: voice, WhatsApp, and SMS reminders for meeting action items, sent to teams in more than 38 countries.
Lexpair and Maidily use it narrower: SMS for lead and booking notifications. Maidily reported no-shows falling 75% after adding automatic reminders, and Twilio is the channel those reminders travel on alongside Stripe and Square for payment. Across all four, the recurring lesson is the same. Treat every webhook endpoint as a public API, because it is one, and start carrier registration before the build is finished rather than after.
- 01Verify the X-Twilio-Signature header on every webhook route before it touches application logic.
- 02Register A2P 10DLC brand and campaign details as soon as the client is confirmed, not at launch week.
- 03Get WhatsApp message templates approved early; template review is a separate queue from account setup.
Systems running on this stack
What teams ask before committing
01How long does Twilio A2P 10DLC registration take?
Registration can run from days to a few weeks, depending on the use case and carrier review queue, rather than being instant. Start it as soon as the business entity and use case are confirmed, well before the send date you are promising a client.
02Is Twilio production ready for a voice AI product?
Yes, for the routing layer. It carries the call and streams the audio reliably in all four systems we run it in. The speech recognition, turn-taking, and reasoning are separate services you choose and wire in yourself. Production readiness for the whole voice agent depends on those choices too, not on Twilio alone.
03How do you stop fake webhook calls to a Twilio integration?
Verify the X-Twilio-Signature header against the request URL and body on every route Twilio calls. Skipping this check is the single most common way a call or message webhook gets treated as trusted input. It is the most common integration mistake we see on this platform.
04What does Twilio cost at real volume?
Voice is billed per minute and messaging per message, with no flat tier, so cost scales directly with usage. A design decision like an extra confirmation call shows up on the next invoice. That makes usage forecasting part of the integration work, not an afterthought.
05Twilio or a dedicated voice AI platform?
Choose Twilio when you want to pick your own speech and reasoning stack, as we did pairing it with Deepgram and OpenAI for ZhoopZhoop. A dedicated voice AI platform suits a team that wants turn-taking handled for it, and is willing to trade flexibility for less integration work.
Related
- TCPA rules for automated service texts →The consent rules that apply before any SMS reminder goes out.
- System integration and API services →Where we do this work.
- n8n review →The automation layer that often sits next to Twilio in these builds.
- Supabase review →The database Lexpair runs on alongside Twilio.
