Changelog

ElevenLabs voices for TwiML Say are now available in public beta, powered by Flash v2 and Flash v2.5 models. Enable via the REST API or a TwiML Bin.

Customers can now configure per-URL webhook authentication and delivery via the Webhook Configuration API, with OAuth 2.0 client credentials flow or Shared Key signatures for securing endpoints, plus configurable timeouts and retries.

Twilio Verify Custom Templates are now generally available, enabling custom SMS/RCS and Voice message templates beyond standard defaults or pre-approved options.

The Java Helper Library now ignores unknown fields in all response objects, fixing deserialization crashes on nested response types. Versions 10.0.0 through 12.1.1 fail with ApiConnectionException when an API response includes an unrecognized field.

SendGrid now offers automatic SSL certificate provisioning as a toggle in the standard link branding setup flow, removing the need to purchase and maintain certificates through an external CDN or DNS provider. The Link Branding API adds an auto_ssl parameter set at creation time, which returns additional DNS records and reports certificate status via auto_ssl_available; Gmail is set to warn on non-HTTPS links by end of October 2026.

Effective August 19, 2026, Twilio Verify changes the default Geo Permissions setting for Italy and Argentina from "Allow all traffic" to "Monitor all traffic for fraud" on all accounts still using the default state. Existing custom configurations are unaffected; Fraud Guard must be enabled for the monitoring protection to apply.

Customers can now send WhatsApp Content Templates to many recipients at once via the Bulk Messaging API, with per-recipient personalization. Configurable fallback now also supports WhatsApp to SMS and RCS to WhatsApp strategies.

Twilio is retiring Functions Classic and automatically migrating all accounts to the new Functions, with no action required from customers. New Functions (Classic) creation stops September 13, 2026, and migration of existing functions, URLs, environment variables, and code runs between September 14 and October 26, 2026.

Customers can now use the Consent Management API to programmatically re-opt-in users on US and Canada toll-free numbers, bypassing the previous requirement that opt-outs could only be lifted via an opt-in keyword text. This eliminates 21610 (Unsubscribed Recipient) and 30004 (Message Blocked) errors for re-consented users.

Twilio will rotate the end-user TLS certificate for all REST API endpoints on September 9, 2026, renewing the certificate and its serial number while root and intermediate certificates remain unchanged. Customers using Twilio Helper Libraries need no action; those pinning certificates should test against https://tls-test.twilio.com starting August 12, 2026.

Starting September 15, 2026, Twilio will return new error codes for Toll-Free Verification and A2P 10DLC campaign registration rejections, providing clearer feedback on why registrations were rejected.

Dedicated IPs are now available for Twilio Email with automatic 41-day warmup schedules and shared pool overflow protection. Organizations can segment traffic by grouping IPs into custom pools, assign specific IPs to sub-accounts, and configure fallback options.

The Twilio Voice JavaScript SDK now includes noise cancellation reference components for either open-source RNNoise or commercially-licensed Krisp, providing a production-ready starting point.

Twilio is introducing a new regional IP address for Event Streams webhook traffic in US East (us-east-1) on September 15, 2026, moving from a shared IP range to dedicated regional addresses. Customers who validate incoming webhook traffic by source IP address must update their allowlists; others require no action.

Effective August 3, 2026, the Send to Coworker action has been removed from the Domain Authentication setup flow due to low usage. Twilio SendGrid recommends using internal communication channels like Slack, Microsoft Teams, or internal ticketing systems to share DNS record updates with IT or infrastructure teams instead.

Conversations (classic) now supports whatsapp/card and whatsapp/flows content types, letting you send WhatsApp Card templates and WhatsApp Flow templates directly through the Conversations API. Build these content types with the Content Template Builder and reference them by SID when sending a message.

Restricted API Keys now support granular, resource-level permissions for Conversations (classic), covering actions like listing conversations, sending messages, managing participants, and configuring webhooks. You can scope a key to only the operations needed, reducing blast radius if a key is compromised.

US Branded Calling is now generally available for all customers on T-Mobile and Verizon, allowing you to display branded elements like your logo and call reason when reaching out to customers.

On September 1, 2026, date_created and date_updated on Functions and Assets resources will return accurate UTC timestamps instead of values shifted forward by 7 hours. The correction applies retroactively to all resources. Integrations depending on these fields for sorting, filtering, display, time-range comparisons, or audit logic should be reviewed before that date.