# Twilio integration: Pilotiko's text messages, no fake sends

> What the Twilio connection does in Pilotiko: encrypted SID and token, reminder texts with real delivery status. The AI phone receptionist is coming soon.

Updated on October 15, 2026 · https://app.pilotiko.com/en/integrations/twilio

With your Twilio Account SID and auth token, Pilotiko is set up to send confirmation and reminder texts and read their delivery status from Twilio. Status: Being commissioned: the connector is written and tested against a test server; it has not yet been verified with a real account. Nothing is sent yet. AI receptionist: coming soon.

## In short
- You connect with an Account SID and auth token, checked and then encrypted.
- Reminders 24 h and 1 h before appointments are planned; nothing is sent yet.
- Each text's status is read from Twilio, never assumed.
- The AI phone receptionist is coming soon and has never handled a real call.

## What does the Twilio connection do?

It links your Twilio account so that, once commissioning is done, Pilotiko can text your customers from your number and track every message.

Twilio supplies the phone numbers and carries the texts; Pilotiko decides what to send and when. To send a text, Pilotiko calls Twilio's Messages resource with three values: the recipient (To), your number (From) and the text (Body) [1]. Twilio then reports a status such as queued, sent, delivered, undelivered or failed [1]. Pilotiko shows that status as Twilio gives it; a message is never marked delivered on hope.

The sending engine has three safeguards. A unique key per message prevents double sends. The same text to the same number within 10 minutes is dropped as a duplicate. On a temporary error it retries after 1 minute, 5 minutes and 30 minutes, for 4 attempts in total.

When Twilio calls back into Pilotiko (a customer reply, an incoming call), the request is checked against the X-Twilio-Signature header, an HMAC-SHA1 computed with your auth token [2]. Pilotiko validates it against its configured public URL, not against the Host header, which a third party could forge.

- **Credentials requested**: Account SID (starts with AC, 34 characters) and auth token (at least 16 characters). Pilotiko offers no one-click connection for Twilio.
- **Read**: account name, your Twilio numbers and the status of each text.
- **Written**: text messages, plus a number's voice settings once the receptionist is switched on.
- **Needs approval**: anything out of the ordinary goes through a person; appointment reminders follow the settings you approve.

## How do you connect Twilio to Pilotiko?

1. **Open your Twilio account** — Find the Account SID and auth token in the Twilio console.
2. **Paste them into Pilotiko** — On Pilotiko's Phone page, choose Twilio. The format is checked before any network call.
3. **Let Pilotiko verify** — Pilotiko asks Twilio to confirm the account and list your numbers. The credentials are then encrypted.
4. **Pick the sending number** — With several numbers, Pilotiko uses your declared line, otherwise the account's first number.
5. **Choose Twilio for texts** — In your business decisions, set Twilio as the text provider. Without that choice, no text is queued for sending.

## What is available, being commissioned or coming soon?

| Feature | Status | Detail |
|---|---|---|
| Credential check and number list | Being commissioned | Tested against a fake Twilio server |
| Confirmation and reminder texts (24 h and 1 h) | Being commissioned | Code ready; nothing sent yet |
| Delivery status read from Twilio | Being commissioned | queued, sent, delivered, undelivered, failed |
| Signed webhooks (X-Twilio-Signature) | Being commissioned | Validated against the configured public URL |
| AI phone receptionist | Coming soon | Test calls in simulation; fr-CA speech recognition never exercised |
| Buying a number through Pilotiko | Coming soon | Code written, never run on a real account |

## How many texts does a week of appointments add up to?

**Example: a Winnipeg massage clinic with 45 appointments a week**

Once commissioning is done, every appointment would trigger one confirmation and two reminder texts.

- Appointments per week : 45
- Texts per appointment : 3 (confirmation, 24 h reminder, 1 h reminder)
- Texts queued per week : 135
- Duplicates avoided (same text within 10 min) : say 2
- Texts retried after a temporary error : say 5, 4 attempts each at most
- Texts marked delivered : only those Twilio reports as delivered
- **= About 133 texts a week, each with its real status; the cost per text depends on Twilio's pricing and is not measured by Pilotiko.**

## What happens to customers' phone numbers, and how do you revoke access?

A phone number is personal information. Before collecting it, a business must tell the person the purposes, the means, their rights of access and correction and their right to withdraw consent (s. 8 of Quebec's private-sector privacy act), and consent must be manifest, free, enlightened and given for specific purposes (s. 14) [3]. Twilio processes the messages for you: the Act frames that kind of mandate with a written contract setting out protection measures (s. 18.3) and calls for a privacy impact assessment before information leaves Quebec (s. 17) [3].

Twilio credentials are encrypted (AES-256-GCM) and never leave the server. Disconnect in Pilotiko erases them and records the action in the audit log. At Twilio, replace your auth token in the console and the old one stops working. More on our [privacy page](/en/privacy) and [subprocessor list](/en/subprocessors).

## What are the limits of the Twilio integration?

For email confirmations, see [Gmail](https://app.pilotiko.com/en/integrations/gmail) or [Outlook and Microsoft 365](https://app.pilotiko.com/en/integrations/outlook-microsoft-365). For your website's domain, see [Cloudflare](https://app.pilotiko.com/en/integrations/cloudflare). Everything else: [integrations](https://app.pilotiko.com/en/integrations).

- No real text has gone out yet. The first test needs a Twilio trial account and a public HTTPS address for Pilotiko.
- The AI receptionist is not on offer. Don't plan around it until its status changes.
- Text and number pricing is Twilio's; Pilotiko doesn't measure it yet, so it doesn't display it.
- Bulk texting and marketing campaigns are not part of this integration.

## Frequently asked questions

### Does Pilotiko send texts already?

No. The sending, retry and tracking code is written and tested against a fake Twilio server, but no real text has gone out. The status stays at being commissioned until the first real test.

### Will the AI receptionist answer my calls?

Not yet: it's coming soon. The code exists and test calls run in simulation, but Canadian French speech recognition has never been tried on a real call.

### Why do I paste a token instead of clicking Connect?

Pilotiko offers no one-click connection for Twilio. It checks the SID and token with Twilio, then encrypts them, and they are never displayed again.

### How do I know a text really arrived?

Pilotiko reads the status from Twilio: delivered means a delivery receipt came back, undelivered means it did not reach the person and failed means it never left. Nothing is assumed.

### Could a customer get the same reminder twice?

Pilotiko guards against it: every message has a unique key, and an identical text to the same number within 10 minutes is dropped. After an uncertain outage it checks with Twilio before resending.

### Who pays for the texts?

Texts go through your Twilio account at Twilio's rates. Pilotiko doesn't measure that cost yet.

## Sources

1. Twilio Docs, « Message resource », https://www.twilio.com/docs/messaging/api/message-resource (accessed on 2026-10-15)
2. Twilio Docs, « Webhooks security », https://www.twilio.com/docs/usage/webhooks/webhooks-security (accessed on 2026-10-15)
3. LégisQuébec, « Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) », https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 (accessed on 2026-10-15)