Twilio BYOP SMS with CTIA STOP-keyword handling + recipient-dedup + `sms.*` events. Honest about what's not built yet.
Twilio is a wire. Customer.io SMS is a thin wrapper. Sendora SMS is also a thin wrapper — leaner than the others — that shares the same recipient-dedup window as Email (no double-send post-signin) and emits canonical `sms.sent / .delivered / .failed` events into the same bus as every other module. Honest about scope: today this is a Twilio-only adapter (no MessageBird / Sinch yet), with one-recipient-at-a-time send (audience fan-out via Automation workflow), CTIA-compliant STOP keyword set that suppresses **this org's SMS** (not all channels), and no Deep Links auto-wrap on outbound bodies.
Coming soon. SMS is built and running internally, but not yet generally available while we roll modules out in batches. Start free today with the available modules — we'll enable SMS on your account as it ships.
Features
- Twilio integration —
POST /orgs/:orgId/sms/send, per-org webhook URLPOST /sms/webhooks/twilio/:orgIdwith x-twilio-signature verification. Honest: MessageBird + Sinch adapters are not built today. - CTIA-compliant STOP keyword handling — inbound
STOP / STOPALL / UNSUBSCRIBE / CANCEL / END / QUITwrites tosms_suppressions;START / UNSTOP / YESre-subscribes. Honest: suppression is sms-only + per-org; does NOT propagate to email/push for the same recipient. - Recipient-dedup at dispatch — same
(orgId, recipient, body)within 60s →status='suppressed' suppressed_reason='recent_duplicate'. Same belt-and-braces as Email. - Pre-send suppression check — recipient on the org's
sms_suppressionslist →status='failed' metadata.suppressed=true. Customer API cannot bypass. - **
sms.*events — `sms.sent` + `sms.delivered` + `sms.failed` fire on the platform bus. Honest:** nosms.repliedevent today — inbound non-keyword messages aren't surfaced as first-class events. - Per-org rate limit + quota meter —
reserveQuotadecrements before send;QuotaExceededErroron hit. - Audit log on every send — actor + resource + payload size recorded.
- Honest non-features: no audience-targeted single-call send (fan-out via Automation workflow); no Deep Links auto-wrap on outbound bodies; no per-region cost controls (international spend caps not built); no MessageBird / Sinch adapters; no Verify-API integration for OTP (use Auth Service's email OTP instead).
Common use cases
BYOP Twilio SMS in a stack where the same tenant also handles Auth + Customers + Audit — useful when you need the dedup window + STOP keyword compliance without a separate platform.
Cross-channel lifecycle via Automation workflows where SMS is a step (Push → wait → Email → SMS) — fan-out happens per-step.
Transactional SMS (order confirmations, alerts) where you already pay Twilio + just need the platform-level send + audit + suppression layer on top.
Start in minutes. Scale without switching tools.
The free tier covers most side projects. Every module is turn-key and every SDK is first-party.