Skip to content

Setting Up Twilio in Floh — A Simple Guide

This guide walks you through connecting Twilio to Floh so your organization can send text messages and automatically handle replies like STOP and START. It is written for a deployed (hosted) Floh environment and assumes no technical background — if you can copy and paste a few values and click a button, you can do this.

You will do three things:

  1. Gather a few pieces of information from Twilio.
  2. Enter them into Floh and save.
  3. Click one button to turn on webhooks.

That's it. Floh handles the complicated parts for you.

What is Twilio, and what are we connecting?

Twilio is the service that actually sends and receives text messages on Floh's behalf. To let Floh use your Twilio account safely, you give Floh a few identifiers and a key. You do not need to give Floh your main Twilio password or your account's master token.

Step 1: Gather what you need from Twilio

You'll need four pieces of information. Here's what each one is, what it looks like, and where to find it in the Twilio Console (Twilio's website where you manage your account).

What you need What it looks like Where to find it in Twilio
Account SID Starts with AC, e.g. AC1a2b3c… Shown on the main dashboard/home page when you log in to the Twilio Console.
API Key SID Starts with SK, e.g. SK9x8y7z… Go to Account → API keys & tokens and create a new Standard API key. The SID is shown after you create it.
API Key Secret A long random string Shown only once, right after you create the API key above. Copy it immediately and keep it somewhere safe — Twilio will not show it again.
Phone number In the format +14155551234 Go to Phone Numbers → Manage → Active numbers. Use a number that has SMS (texting) enabled. If you don't have one yet, you can buy one in the Twilio Console.

A few tips:

  • The API Key is not your password. An API Key is a limited, revocable credential you create specifically for apps like Floh. If it is ever compromised, you can delete just that key in Twilio without affecting anything else. This is why Floh asks for an API Key instead of your account password or master token.
  • If you lose the API Key Secret, you can't look it up later — just create a new API key and use the new SID + secret.
  • Advanced (optional): if your organization sends through a Twilio Messaging Service rather than a single number, you can use its Messaging Service SID (starts with MG…) in place of a phone number. If you don't know what that is, use a phone number.

Step 2: Enter your Twilio details in Floh

  1. In Floh, go to Admin → Connectors.
  2. Open your Twilio connector (or create a new connector of type Twilio).
  3. On the connector's Configuration, fill in the fields with the values you gathered:
  4. Account SID — your AC… value
  5. API Key SID — your SK… value
  6. API Key Secret — the secret you copied
  7. From number — your Twilio phone number, e.g. +14155551234
  8. Click Save.

That's all the typing you'll do. In a normal hosted deployment there is nothing else to configure — no URLs to paste, no network settings to change.

Save before the next step. Floh reads your saved settings when it turns on webhooks, so make sure you've clicked Save before continuing.

Step 3: Turn on webhooks

On the connector page, find the Inbound webhooks section and click the Set up webhooks button.

What are webhooks, and what do they do?

A webhook is simply a way for Twilio to notify Floh the moment something happens with a text message — without you having to check manually. Once webhooks are on, Floh can automatically:

  • Honor opt-outs. When someone replies STOP (or UNSUBSCRIBE, CANCEL, etc.) to one of your messages, Floh records it and stops sending them further messages — an important compliance requirement. If they later reply START, Floh resumes.
  • Answer HELP requests. Replies like HELP are recognized and acknowledged.
  • Track delivery. Floh receives updates about whether each message was delivered.

In short: turning on webhooks is what lets Floh listen for and respond to replies, instead of only sending messages one way.

What happens when you click the button

When you click Set up webhooks, Floh does all the setup with Twilio for you, including one important security step behind the scenes:

  • Floh asks Twilio to create a signing key — a secret that only Twilio and Floh share.
  • Floh stores that key securely (encrypted) on your connector. You never see it, copy it, or need to manage it.
  • From then on, every incoming text is stamped by Twilio using that key, and Floh checks the stamp before trusting the message. This is how Floh knows a message genuinely came from Twilio and isn't a fake — anything that doesn't match is rejected.

When everything is ready, the status badge changes to Configured. You're done.

You may be asked to re-confirm your identity (a multi-factor prompt) when setting up or changing webhooks. That's expected — it protects these security-sensitive settings.

If the button is greyed out or says "Not configured"

  • Greyed out: Floh will tell you what's missing (for example, a from number or the API key). Fill in the missing field, Save, and try again.
  • Still "Not configured" after clicking: wait a few seconds and use the refresh/reload option in the same section — Twilio sometimes needs a moment to finish. If it persists, click Set up webhooks once more.

Keeping things secure: rotating the signing key

After setup, you'll also see a Rotate signing key button in the Inbound webhooks section. "Rotating" means replacing the current signing key with a brand-new one.

You might rotate the key if:

  • you suspect the key may have been exposed, or
  • your organization periodically refreshes secrets as good security hygiene.

Like the initial setup, rotation is fully automatic: Floh creates a fresh key, switches Twilio over to it, retires the old one, and stores the new key securely. You don't handle any secret yourself.

One thing to expect: for a brief moment (typically under a minute) while Twilio switches over, an incoming text or two might be momentarily rejected. This is normal. Wait for the badge to read Configured again before considering the rotation complete.

Quick recap

  1. From Twilio: copy your Account SID, create an API Key (SID + secret), and pick an SMS-capable phone number.
  2. In Floh: paste those into the Twilio connector's Configuration and Save.
  3. Click Set up webhooks. Floh creates and stores a signing key for you and flips the badge to Configured.
  4. If a secret is ever a concern, use Rotate signing key to swap in a fresh one.