Twilio BYOP SMS with CTIA STOP-keyword handling + recipient-dedup + `sms.*` events. Honest about what's not built yet.
Twilio is a wire. Customer.io SMS is a thin wrapper. Sendora SMS is also a thin wrapper — leaner than the others — that shares the same recipient-dedup window as Email (no double-send post-signin) and emits canonical `sms.sent / .delivered / .failed` events into the same bus as every other module. Honest about scope: today this is a Twilio-only adapter (no MessageBird / Sinch yet), with one-recipient-at-a-time send (audience fan-out via Automation workflow), CTIA-compliant STOP keyword set that suppresses **this org's SMS** (not all channels), and no Deep Links auto-wrap on outbound bodies.
Features
- Twilio integration —
POST /orgs/:orgId/sms/send, per-org webhook URLPOST /sms/webhooks/twilio/:orgIdwith x-twilio-signature verification. Honest: MessageBird + Sinch adapters are not built today. - CTIA-compliant STOP keyword handling — inbound
STOP / STOPALL / UNSUBSCRIBE / CANCEL / END / QUITwrites tosms_suppressions;START / UNSTOP / YESre-subscribes. Honest: suppression is sms-only + per-org; does NOT propagate to email/push for the same recipient. - Recipient-dedup at dispatch — same
(orgId, recipient, body)within 60s →status='suppressed' suppressed_reason='recent_duplicate'. Same belt-and-braces as Email. - Pre-send suppression check — recipient on the org's
sms_suppressionslist →status='failed' metadata.suppressed=true. Customer API cannot bypass. - **
sms.*events — `sms.sent` + `sms.delivered` + `sms.failed` fire on the platform bus. Honest:** nosms.repliedevent today — inbound non-keyword messages aren't surfaced as first-class events. - Per-org rate limit + quota meter —
reserveQuotadecrements before send;QuotaExceededErroron hit. - Audit log on every send — actor + resource + payload size recorded.
- Honest non-features: no audience-targeted single-call send (fan-out via Automation workflow); no Deep Links auto-wrap on outbound bodies; no per-region cost controls (international spend caps not built); no MessageBird / Sinch adapters; no Verify-API integration for OTP (use Auth Service's email OTP instead).
Common use cases
BYOP Twilio SMS in a stack where the same tenant also handles Auth + Customers + Audit — useful when you need the dedup window + STOP keyword compliance without a separate platform.
Cross-channel lifecycle via Automation workflows where SMS is a step (Push → wait → Email → SMS) — fan-out happens per-step.
Transactional SMS (order confirmations, alerts) where you already pay Twilio + just need the platform-level send + audit + suppression layer on top.
Start in minutes. Scale without switching tools.
The free tier covers most side projects. Every module is turn-key and every SDK is first-party.