Documentation
¶
Overview ¶
Package twilio provides a verifier for Twilio API keys. It uses the Twilio Accounts API GET /2010-04-01/Accounts.json endpoint with Basic auth to check key validity.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks whether a Twilio API key is active by calling the Twilio Accounts API. It NEVER logs or persists raw key values.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(ctx context.Context, raw detector.RawFinding) finding.VerificationResult
Verify checks if the detected Twilio API key is valid/active.
The detector emits the API Key SID ("SK...") as raw.Raw and the Account SID ("AC...") as raw.ExtraData["account_sid"]. Twilio's REST API accepts exactly two Basic-Auth pairs: (Account SID, Auth Token) or (API Key SID, API Key Secret). Since raw.Raw is an API Key SID, the only valid pairing is (API Key SID, API Key Secret): the SID is the Basic-Auth username and the paired API Key Secret is the password. The API Key SID alone is a non-secret identifier and cannot authenticate on its own, so when the paired secret is not available (raw.ExtraData["api_key_secret"] is empty) the key is reported as Unverified — never as inactive, which would misread a live but unpaired credential as revoked.
Source Files