--- name: Changelog slug: twilio-changelog type: feed source_url: https://www.twilio.com/en-us/changelog organization: Twilio organization_slug: twilio total_releases: 45 latest_date: 2026-09-17 last_updated: 2026-09-20 tracking_since: 2026-06-11 canonical: https://releases.sh/twilio/twilio-changelog organization_url: https://releases.sh/twilio --- ## Voice Recording Storage billing updates Twilio will begin migrating accounts to an updated Voice Recording Storage billing system. ## Twilio Heightened Awareness Period (HAP) – November 19, 2026 - January 4, 2027 **Between Thursday, November 19, 2026 and Monday, January 4 2027, Twilio will enter a Heightened Awareness Period (HAP) to help ensure reliable message delivery during peak traffic times, such as Black Friday and Cyber Monday.** During this period, message sending rates to U.S. destinations will be monitored and may be limited at the account level for toll-free, short code, and 10DLC numbers. Accounts that send high volumes of messages from short codes or toll-free numbers may be temporarily migrated to [Market Throughput](https://www.twilio.com/docs/messaging/guides/market-throughput-overview#twilio-docs-content-area) during the HAP. Customers will be notified via email if their account is affected. Market Throughput doesn’t affect 10DLC numbers, which will continue to live on [Account Based Throughput](https://www.twilio.com/docs/messaging/guides/account-based-throughput-overview#twilio-docs-content-area). For more information on how throughput limits may be impacted and what actions to take, customers can reach out to their Twilio account team. ## Twilio integration with Salesforce Service Cloud Voice is now Omnichannel We’re excited to announce that Twilio integration with Salesforce Service Cloud Voice now supports WhatsApp and SMS, alongside existing support for Voice and listed on the [AppExchange](https://appexchange.salesforce.com/appxListingDetail?listingId=1d792d9c-cbea-4452-93d9-66c79972b03d). This release comes with the following enhancements: - Route SMS and WhatsApp conversations through Twilio TaskRouter into the Salesforce Omni-Channel widget, using the same presence, skills, and capacity model as voice - Handle messaging conversations and voice calls concurrently in a single agent console, with agent presence synchronizing across all channels on work acceptance To learn more about setup, please see the [setup guide](https://www.twilio.com/docs/flex/admin-guide/integrations/salesforce-byoccaas). ## Toll-Free Verification Now Requires Privacy Policy and Terms and Conditions URLs Starting **September 15, 2026**, the privacy\_policy\_url and terms\_and\_conditions\_url fields will be required on all new Toll-Free verification submissions. Both fields are available today and are optional until that date. New submissions made on or after September 15 that are missing either URL will be rejected. This change applies only to new submissions. Existing verified numbers are unaffected and do not need to be updated. Support for adding these fields to existing verifications is planned for late 2026 or early 2027. Privacy policy and terms and conditions content have always been required as part of your opt-in details; this change moves them into dedicated URL fields on the submission itself. Both documents must meet Toll-Free verification content requirements, including message and data rate disclosure, message frequency, HELP and STOP instructions, and a statement that mobile information and opt-in consent are not shared with third parties for marketing purposes. For the full list of requirements, see [Requirements and Instructions for Toll-Free Verification Approval](https://help.twilio.com/articles/13264118705051). ## ElevenLabs Voices for Say is now Public Beta ElevenLabs voices are now available in Public Beta for , powered by the Flash v2 and Flash v2.5 models for fast, natural-sounding text-to-speech. Get started by specifying an ElevenLabs voice via the REST API or in a TwiML Bin. ## Webhook Configuration API is now in Public Beta Using the Webhook Configuration API, customers can configure how Twilio authenticates and delivers outbound webhooks, per URL. The API consists of two resources: Webhook Settings and Webhook Rules. Webhook Settings hold the authentication and connection configuration. Customers can secure endpoints with OAuth 2.0. Twilio fetches an access token from the customer's authorization server using the client credentials flow and sends it as a Bearer token in the Authorization header of every webhook or with Shared Key signatures. Customers can also configure delivery behavior like timeouts and retries. ## International Call Forwarding - Compliance Blocking for Spain & France ## Verify Custom Templates are now Generally Available [Verify Custom Templates](https://www.twilio.com/docs/verify/verification-templates#custom-templates) give you the flexibility and security to use custom SMS/RCS and Voice message templates beyond standard [defaults or pre-approved options](https://www.twilio.com/docs/verify/verification-templates). To learn more about how to create a custom template for your business needs, check out our [support guide](https://help.twilio.com/articles/9960174409627-Is-it-Possible-to-Customize-the-Verification-Message-for-Verify-). ## Critical fix: Java Helper Library 13.0.0: fixes crash on unknown fields in nested API responses **The Java Helper Library now handles unknown fields gracefully in nested response objects, but if customers are on an affected version, their integration is at risk until they upgrade.** Versions 10.0.0 through 12.1.1 parse nested response types (profile, configuration, webhook, and others) with strict deserialization. When an API response comes back with a field the SDK doesn't recognize, the request fails with ApiConnectionException: Unable to deserialize response: Unrecognized field. Because Twilio APIs can add new optional fields at any time, this is a latent break. Customers’ integrations work today and can start failing without warning the moment a new field ships. In 13.0.0, the Java Helper Library ignores unknown fields in all response objects, matching how every other Twilio Helper Library already behaves. **What to do** Upgrade to Java Helper Library 13.0.0 or later as soon as possible. Version 13 does include breaking changes so follow the [upgrade guide](https://github.com/twilio/twilio-java/blob/main/UPGRADE.md#2026-08-26-12xx-to-13xx) to migrate safely. Once customers are on 13.0.0, their integration handles new optional fields in API responses without hitting deserialization errors. The Python, Node.js, C#, Ruby, PHP, and Go Helper Libraries are not affected. They already handle unknown response fields the same way. ## Update to Twilio SendGrid Link Branding: Automatic SSL Certificate Provisioning Twilio SendGrid has added automatic SSL certificate provisioning as a toggle within the standard link branding setup flow. When enabled, SendGrid provisions and hosts the SSL certificate needed to serve tracking and branded links over HTTPS, removing the need to purchase, install, and maintain a certificate through an external CDN or DNS provider. Twilio SendGrid recommends activating this setting for all link branding domains. Gmail is rolling out warnings on non-HTTPS links by the end of October 2026, and tracking links without SSL will see reduced click-through as a result. Enabling automatic SSL requires adding two additional DNS records provided by SendGrid, alongside the CNAME records already used for link branding. The Link Branding API now supports a new auto\_ssl parameter when creating a branded link. Setting auto\_ssl to true provisions the certificate automatically, returns the additional DNS records needed to complete setup, and reports certificate status through a new auto\_ssl\_available field once the certificate is issued and live. auto\_ssl can only be set when a link is created and can't be changed afterward. ## Verify tightens fraud prevention geo permissions for Italy and Argentina Twilio has observed a sudden rise in SMS Pumping fraud (aka SMS Artificially Inflated Traffic) targeting messages to Italy (IT) and Argentina (AR). To protect customers from this activity, Twilio Verify is tightening its fraud prevention posture for these two countries, effective August 19, 2026. Specifically, Twilio is updating the default Verify Geo Permissions setting for Italy and Argentina from "Allow all traffic" — the default state at account creation — to "Monitor all traffic for fraud." This change applies to all existing accounts where IT and/or AR remain in the default "Allow all traffic" state. **What this means for customers** - If your account still has IT and/or AR set to the default **"Allow all traffic"** permission, it will be updated to **"Monitor all traffic for fraud"** starting August 19, 2026. - If you've already changed the geo permission for IT or AR away from the default “Allow all traffic” (to any other state), your configuration will not be modified by this update. - The protection provided by "Monitor all traffic for fraud" requires that you have Fraud Guard enabled. - No action is required for customers with Fraud Guard enabled. This update happens automatically for in-scope accounts. Customers that revert the status back to “Allow all traffic” risk SMS Pumping fraud and are responsible for payment to all traffic to IT and AR. - You can review or change your geo permissions at any time from the [Verify Geo Permissions page](https://www.twilio.com/console/verify/geo-permissions) in the Twilio Console. ## Bulk Messaging Supports WhatsApp Content Templates Customers can now send Content Templates to many recipients at once and personalize the template for each recipient using the Bulk Messaging API. This update enhances and simplifies sending notifications and marketing messages campaigns. With Bulk Messaging's configurable fallback, this release also enables new fallback strategies including WhatsApp to SMS and RCS to WhatsApp. [Read the tutorial](https://www.twilio.com/docs/bulk-messaging/send-whatsapp-messages-with-content-templates) to get started today! ## Functions Classic is being deprecated and existing Functions (Classic) are moving to the new Functions Twilio is retiring Functions Classic and automatically migrating all accounts to the new Functions. No action is required from customers. **What's changing with Twilio Functions** Starting September 13, 2026, customers won’t be able to create new Functions (Classic) and assets. Existing Functions (Classic) and assets will continue running, and customers can still edit and deploy existing code during this window. Between September 14 and October 26, 2026, Twilio will migrate all active Functions (Classic), existing URLs, function and asset names, environment variables, and deployed code to the new Functions. **Need a hand?** These resources will help: - [Migrating from Functions (Classic) to the new Functions Editor](https://www.twilio.com/docs/serverless/functions-assets/functions/migrating-functionsclassic-new-functions-editor) - [Upgrading Node.js for Twilio Functions](http://node.js) - [Functions Documentation](https://www.twilio.com/docs/serverless/functions-assets/functions) - [Serverless Toolkit](https://www.twilio.com/docs/labs/serverless-toolkit) ## Consent Management API Now Supports Toll-Free Network-Level Opt-Out Overrides Customers can now use the Consent Management API to programmatically re-opt-in users on US and Canada Toll-Free numbers. Previously, opt-outs on US/CA Toll free numbers were strictly enforced at the network level, meaning an opt out block could only be lifted if the user texted an opt-in keyword like "START". Now, if a user provides valid re-opt-in consent outside of a messaging channel (e.g., via a web form, email, or in-app preference center), you can log their updated consent directly through the Consent Management API. Twilio will automatically pass this signal to downstream networks to clear the opt-out block and resume messaging. Key Highlights: - Programmatic Re-Opt-In: Seamlessly restore message deliverability for users who re-consent via external channels. - Fewer Failed Sends: Eliminate [21610](https://www.twilio.com/docs/api/errors/21610) (Unsubscribed Recipient) and [30004](https://www.twilio.com/docs/api/errors/30004) (Message Blocked) error codes for users who have re-consented to receive messages. - Centralized Compliance: Keep your Twilio messaging traffic perfectly synced with your CRM and internal omnichannel engagement and consent workflows. For more information, see our [Consent Management API docs](https://www.twilio.com/docs/messaging/features/consent-api). ## Twilio end-user certificates for all REST API endpoints will be rotated on September 9, 2026 On September 9, 2026, Twilio will rotate the end-user TLS certificate for all REST API endpoints. Only the end-user certificate and certificate serial number will be renewed; root and intermediate certificates will remain the same. This is a routine update that won’t impact most customers unless they’re pinning certificates or are managing them manually. Customers using the [Twilio Helper Libraries](https://www.twilio.com/docs/libraries/reference/) don’t need to take any action since the change will be handled automatically. Twilio recommends against certificate pinning because it creates potential security risks, can cause downtimes for services, and a higher probability of failed API requests. **How to test your connection** The new certificate will be available for testing at https://tls-test.twilio.com starting August 12, 2026. If the request succeeds with a 200 OK, no further action is required. **Need a hand?** These resources have more detail: - [Monitoring Updates to Twilio REST API Security Settings](https://help.twilio.com/articles/226478767-Monitoring-Updates-to-Twilio-REST-API-Security-Settings) - [Security best practices](https://www.twilio.com/docs/usage/security) ## New error codes provide clearer TFV and A2P 10DLC registration feedback launching September 15, 2026 On September 15, 2026, Twilio will add new error codes for Toll-Free Verification and A2P 10DLC campaign registration rejections.  ## Dedicated IPs and IP Management for Twilio Email Dedicated IPs are now available for Twilio Email, enabling streamlined control over email deliverability directly within the Twilio console. This functionality simplifies sending reputation management at scale. To ensure deliverability from day one, newly provisioned dedicated IPs automatically enter a 41-day warm-up schedule, complete with shared pool overflow protection to smooth out volume spikes. Organizations can also segment traffic by grouping IPs into custom pools, assigning specific IPs directly to sub-accounts, and configuring flexible fallback options to maintain continuous email flow. To learn more about how to manage your email reputation and IP warmup, see the <a href="https://www.twilio.com/docs/email/concepts/reputation/establish-maintain-reputation">Twilio Docs</a>. ## Twilio Voice JS SDK Noise Cancellation Reference Components The Twilio Voice JavaScript SDK now includes noise cancellation reference components, giving you a production-ready starting point for either open-source RNNoise or commercially-licensed Krisp. ## New Regional IP Address for Event Streams Webhooks in US East On September 15, 2026, Twilio is introducing a new regional IP address for Event Streams webhook traffic in US East (us-east-1). This is part of a move from a single shared IP range to dedicated regional addresses, bringing Event Streams in line with how the rest of the Twilio platform routes traffic. This change only affects customers who validate incoming Event Streams webhook traffic by source IP address. If a setup doesn’t check the source IP, no action is needed. ## Update to SendGrid Domain Authentication: Send to Coworker Action Removed Effective August 3, 2026, Twilio SendGrid has removed the Send to Coworker action from the Domain Authentication setup flow due to low usage. This simplification prioritizes only the most valuable paths for users to complete their domain authentication and get started with email. Directing DNS records through automated email is no longer the optimal method for technical handoffs. DNS configurations are highly sensitive to formatting, and transferring this data via email can increase the risk of errors during the setup process. This change ensures that critical security records are managed through more intentional and reliable methods. For users of the Send to Coworker action, Twilio SendGrid recommends reaching out directly to your IT or infrastructure teams via internal communication channels, such as Slack, Microsoft Teams, or internal ticketing systems. Sending DNS record update requests through internal communication channels ensures recipients trust the request. Utilizing these established workflows also delivers the necessary context and data in a format that aligns with an organization’s standard practices for updating DNS records.