title: Phone verification using Twilio on mobile app without revealing Auth Token
body: <p>I'm interested in making a registration system on an app that verifies the user is not a robot. I'm considering using Twilio's <a href="https://www.twilio.com/verify" rel="nofollow noreferrer">phone verification API</a> to send a text with a code to the user's phone.</p>
  
  <p>To use Twilio's API, you need to provide an Auth Token associated with the Twilio account. I obviously don't want to include this token in the app since it can easily be decompiled. </p>
  
  <p>Twilio suggests putting the token on my server and not on the client: <a href="https://www.twilio.com/blog/protect-phishing-auth-token-fraud" rel="nofollow noreferrer">source</a>.</p>
  
  <blockquote>
    <p>Never hard-code keys or tokens in your app. It is trivial to retrieve these credentials by decompiling the app. To further avoid such exposure during app development, make the Twilio API calls from your server and not the client.</p>
  </blockquote>
  
  <p>This only seems to help marginally. I could create an API on my server which calls the Twilio API, but I can't secure it, because my app needs to access it before the user is registered (Since this API will be used DURING registration).</p>
  
  <p>What are the best practices in this situation to secure the Twilio Auth Token?</p>