Twilio Error 20003

Twilio Error 20003 is the REST API's generic authentication failure, returned with HTTP status 401 Unauthorized. Per Twilio's official error reference, it "usually means the credentials on your request are incorrect, expired, deleted, scoped to the wrong account, or not valid for the resource you are trying to access." It is the same underlying problem whether the message reads "Permission Denied," "Authenticate," or "Authentication Error - invalid username."

What causes Twilio Error 20003?

Twilio raises 20003 whenever it cannot validate the credentials in the HTTP Basic Auth header (or the bearer/Access Token) of your request. Common, documented causes:

• Wrong Account SID + Auth Token combination, or credentials with stray spaces, newlines, or extra characters copied in.
• A deleted or rotated Auth Token / API Key that is still referenced by your app, environment variable, or secret store.
• Test Credentials used against live resources (or against an endpoint that does not accept test credentials), or vice versa. (Test Credentials used against a resource type Twilio does not support for testing may instead return HTTP 403 Forbidden rather than 401/20003, depending on which Twilio subsystem rejects the request.)
• Subaccount vs. main account mismatch — using subaccount credentials to reach the main account (or another subaccount), or using a Standard API Key where a Main (account-level) operation like /Accounts requires one.
• Region mismatch — an API Key created in one Twilio Region used against a request routed to a different region.
• A proxy or middleware stripped the Authorization header before the request reached Twilio.
• Auth Token used to sign a JWT (Access Token) instead of an API Key SID + Secret, which is what JWT-based workflows require.
• Suspended or closed account, an expired OAuth access token, or an unaccepted addendum gating the feature.

How do I fix Twilio Error 20003?

1. Confirm the exact credentials. Copy your Account SID (starts with AC) and Auth Token fresh from the Twilio Console; trim whitespace. For production, prefer an API Key SID (SK...) + Secret; Account SID + Auth Token is fine for testing.

# Basic Auth: the request that 20003 rejects
curl -X POST "https://api.twilio.com/2010-04-01/Accounts/$TWILIO_ACCOUNT_SID/Messages.json" \
  --data-urlencode "To=+15558675310" \
  --data-urlencode "From=+15017122661" \
  --data-urlencode "Body=test" \
  -u "$TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN"

If you authenticate with an API Key, the -u pair becomes SK_KEY_SID:API_KEY_SECRET and the SID in the URL path stays your AC... Account SID.

2. Replace anything deleted or rotated. If a token or key was deleted, regenerate it and update every environment variable, secret manager, and deployed instance still using the old value.
3. Match the account scope. Use the credentials that belong to the account (or subaccount) that owns the resource. Use a Main API Key for account-level (/Accounts) operations.
4. Match the region. If you use Twilio Regions, create/use credentials in the same region the request is sent to.
5. For JWT/Access Token flows (Voice SDK, Video, Conversations), sign tokens with an API Key SID + Secret, never the Auth Token.
6. Check account status and middleware. Verify the account is active (not suspended) in the Console, and confirm no proxy or gateway is dropping the Authorization header.

If you reach Twilio through Courier, store your Account SID and Auth Token (or API Key + Secret) in the Twilio provider configuration and re-save after any rotation so Courier sends the current credentials.