Twilio API Key Expiration vs. Revocation: Unresolved Behavior

Twilio API Key Expiration vs. Revocation

Twilio allows API keys to be scoped to specific services and to be set with an expiration date. When the expiration time passes, Twilio rejects requests authenticated with that key, returning a 401 Unauthorized. Revoking an active key also results in immediate rejection. Documentation does not clarify the interaction between these two mechanisms, nor whether an expired key can be revoked or reactivated, or whether revocation overrides expiration.

Given the need for least‑privilege authentication in production systems, it is important to understand how Twilio treats keys that are both expired and revoked, and whether a key can be re‑enabled after expiration.

Questions:

• When a key is marked as expired but remains listed as active, does revoking it immediately invalidate the key, or is the expiration already the effective state?
• Is it possible to reactivate an expired key with the same identifier, and if so, how does Twilio enforce scope and expiration upon reactivation?
• Do revocation and expiration operate independently, or does one supersede the other in Twilio’s authorization logic?