The access token that lets a browser place and receive calls. Identity is org__user rather than a bare user id, and the token is minted on the Twilio account that actually owns the caller ID being presented. The agency's own calls are a separate, capability-gated identity.
Also called: someone else's call rang on my screen · call security · wrong account got the call
- 1Identity is built as `${orgId}__${userId}` with a double underscore, because Clerk ids contain single ones
- 2The JWT is signed with node crypto rather than pulling a ~10MB SDK server-side for one signature
- 3TTL is one hour; the client refreshes on tokenWillExpire
- 4Agency scope requires the tenants.impersonate platform capability, never a query string
Browser calling identities are global to the carrier account, so an unscoped one could collide between two businesses — and the worst version of that is one builder's incoming call ringing on another builder's screen. There was a second failure underneath it: a calling identity minted on the wrong account can only present caller IDs that account owns, so outbound calls from a builder's own number died every time. Identities are now scoped per account and minted on the account that owns the line, with a one-hour lifetime.
- Cross-tenant call collisions
- Outbound calls rejected because the caller ID isn't owned by the token's account
- Tokens expiring mid-shift
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →