> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Twilio SMS verification

> Distinguish the website demo's phone verification from workspace SMS, and prepare bounded code verification and failure handling.

Threetone's website demo has a dedicated Twilio Verify flow. It sends a code and checks approval before proceeding with a demo-call request. This is not a public workspace verification API, an SMS conversation channel, or proof that calling is available for your deployment.

## Prepare an application verification flow

For a separate application, identify the action being protected, the server responsible for verification, and the provider account owner. Use [Twilio Verify's Service, Verification, and Verification Check model](https://www.twilio.com/docs/verify/api). Do not copy demo-only routes into an application integration.

<Steps>
  <Step title="Bind the intended action">Associate the destination and verification attempt with the application request. A checked phone code should not grant access to unrelated workspaces or actions.</Step>
  <Step title="Bound code delivery">Validate the destination before sending. Define cooldowns and attempt limits on the server, and display retry timing in the interface. Keep provider credentials and verification requests server-side.</Step>
  <Step title="Check the result">Continue only after the provider approves the verification. Handle expired, incorrect, and exhausted codes explicitly. Do not treat a successful send response as a successful check.</Step>
  <Step title="Handle the protected action separately">A later call can fail even after verification succeeds. Keep code status, action authorization, and call status distinct so the user receives an accurate result.</Step>
</Steps>

## Existing demo behavior

The demo checks phone and IP eligibility, applies send limits, and can return retry timing. Its call flow requires the code check to succeed and has separate configuration and execution requirements. Keep OTP values out of logs, screenshots, and support tickets.

For a failed attempt, distinguish invalid destination, send cooldown, wrong or expired code, and downstream call failure. Do not resend automatically after every error.

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Does verification enable SMS on an imported number?" id="twilio-sms-verification-faq-routing">No. Workspace SMS routing remains disabled. Verification is a separate provider workflow.</Accordion>
  <Accordion title="Does an approved code establish consent for future calls?" id="twilio-sms-verification-faq-consent">Do not treat it as a substitute for reviewing the intended use, consent records, and applicable requirements. See [call consent](/agents-platform/legal/call-consent).</Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.