nullcipher

Twilio API keys (SK…)

SK followed by exactly 32 hexadecimal digits: the SID that identifies a Twilio API key. Its secret has no prefix and is masked only after a secret-named key. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Twilio API key

What an AI chat would receive after masking

# EXAMPLE values, not real credentials
TWILIO_API_KEY=[TWILIO_API_KEY_1]
TWILIO_API_SECRET=[SECRET_1]

1 × Twilio API key found and masked, plus 1 other finding.

How nullcipher recognises it

Checked only when the text contains “sk” (any case). Pattern (gitleaks rule twilio-api-key, v8.30.1, translated to JavaScript): /SK[0-9A-Fa-f]{32}/ — the whole match is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 3 bits per character, so repetitive placeholders like xxxx are left alone.

This is the rule text of the “Twilio API key” detector in the masking engine, copied from the engine when this page was built; the rule is ported from gitleaks’ default rule set (MIT licence; version, skipped rules and changes). Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

# EXAMPLE values, not real credentials
TWILIO_API_KEY=SK0123456789abcdef0123456789abcdef
TWILIO_API_SECRET=EXAMPLEexampleEXAMPLEexample0000

nullcipher replaces it with [TWILIO_API_KEY_1]. The SID is the hex digits 0-f twice, the secret spells EXAMPLE. Twilio never issued either. Note how the two are caught by different rules: the SK… SID by the Twilio rule, the secret only because its key name contains SECRET.

Why it matters in an AI chat

A Twilio API key has two parts: the SK… string, which Twilio's Key resource calls the SID and which identifies the key, and a secret shown once at creation. Together they authenticate to Twilio's REST API in place of your account's Auth Token.

Twilio's docs say you can revoke API keys at your discretion and should revoke one that is compromised. A standard key can send SMS and place calls billed to your account, which is why leaked Twilio credentials are abused for toll fraud.

Limit of this rule: the API key secret and the account Auth Token are 32 characters with no prefix. nullcipher masks them only when they sit after a secret-named key such as TWILIO_API_SECRET= or auth_token=; pasted on their own they go through.

If it already leaked

  1. Delete the key in the Console: Settings → API keys & tokens, click the key's name, then Delete this key and confirm. Twilio documents that deleting a key revokes its permissions. [2]
  2. Or through the API: DELETE on the key's resource under iam.twilio.com/v1/Keys/{Sid}. Twilio says this revokes the key's authorization to the REST API and invalidates all Access Tokens generated with it. [3]
  3. Create a new key, preferably a Restricted API key with only the permissions the app needs, and update the app. [1]

Sources

  1. API keys overview — Twilio Docs — checked 2026-09-25.
  2. Manage API keys in the Twilio Console — Twilio Docs — checked 2026-09-25.
  3. REST API: Key resource (v1) — Twilio Docs — checked 2026-09-25.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.