Sending SMS with n8n and Twilio: alerts, reminders and OTP verification

Slack, Telegram, and email cover most alerting needs in an n8n workflow — but none of the three guarantees a read within minutes. A landmark systematic review on appointment reminders, Hasvold & Wootton (2011), Use of telephone and SMS reminders to improve attendance at hospital appointments: a systematic review, published in the Journal of Telemedicine and Telecare, measured across 29 studies an average 34% reduction in non-attendance thanks to a simple SMS or phone reminder — well beyond what an email-only reminder achieves. SMS isn't a marketing gimmick: it's the channel that reaches someone who isn't watching Slack or their inbox at that exact moment.

n8n ships a native Twilio node for sending and receiving SMS without writing integration code. This guide covers its setup and three concrete use cases: an urgent alert, a reminder, and code-based verification.

Why add SMS, not replace anything with it

SMS costs more per message than Slack or email (a few cents per send, versus a marginal cost for the other two) and doesn't suit long or richly formatted messages. It complements your existing channels for cases where read latency genuinely matters:

• A maximum urgency score detected by the email urgency scoring workflow deserves a channel that rings even with a locked phone, not just a Slack notification waiting for someone to reopen the app.
• Human approval via Slack buttons remains the right answer for a team already connected continuously; SMS takes over for an external contact, a client, or a vendor who doesn't have Slack.

The principle to keep: only add SMS where response speed genuinely changes the outcome — a critical alert, a deadline reminder, an identity check — not as a default notification channel.

Setting up the Twilio node in n8n

Three things to gather before building the workflow:

1. A Twilio account with a purchased number (a few euros a month) able to send SMS in your recipients' country — some countries require prior sender registration (A2P 10DLC in the US, for instance).
2. Account SID and Auth Token, visible on the Twilio dashboard, entered into a dedicated n8n credential — the same principles covered in our guide on securing n8n API credentials apply: never hardcoded in a Code node, never committed in a shared workflow export.
3. Numbers in E.164 format (+33612345678, country code included, no spaces or parentheses): the most common cause of a first Twilio send failing is a badly formatted number, silently rejected by the API.

Sending a simple SMS

The Twilio node (resource "SMS", operation "Send") takes three essential parameters: the sender number (your Twilio number), the recipient number, and the message body. In a typical alert workflow, it sits downstream of a node that has already decided to alert — an IF on a score, a Switch on a category — exactly like a Slack node would in our pack workflows. The message itself is built with a standard n8n expression, interpolating the relevant fields (file number, deadline, tracking link) into a short text: an SMS beyond 160 characters is billed by Twilio as multiple segments, so keeping it concise pays off by design.

Receiving a reply: the Twilio Trigger node

For two-way use — appointment confirmation, a "STOP" reply, a verification code sent back by the user — the Twilio Trigger node exposes a webhook you register in the Twilio console (Messaging section → number configuration). Every incoming SMS triggers the workflow with the message body and sender number as input. As with any publicly exposed webhook, the usual reflexes apply: verify the request actually comes from Twilio (the X-Twilio-Signature header, comparable to the authentication described in our guide on securing an n8n webhook), and handle idempotence in case Twilio retries the webhook delivery after a slow response — the same principle covered in our article on n8n webhook idempotence.

Use case 1: SMS alerts for genuine emergencies

Building on the email urgency scoring workflow, it only takes one extra branch: beyond a second threshold, higher than the one that already triggers the Slack alert (a score of 5 out of 5, say, rather than 4), a Twilio node sends an SMS to the on-call person in addition to the Slack notification. The score is still computed once by the LLM; only the output channel branches out based on severity.

Use case 2: reminders for files and abandoned carts by SMS

Our guides on automated reminders for incomplete files and abandoned cart recovery both rely on a cron that identifies pending files or carts and sends an email reminder. SMS fits in naturally as a second channel for the latest-stage reminders (day 3, day 7): an email open rate that plateaus around 20% justifies switching to a channel the recipient checks almost systematically within the hour. The Twilio node runs in parallel with the existing email node, on the same trigger condition.

Use case 3: code-based verification (OTP)

To secure a sensitive action — validating a compliance file like in the Compliance & Audit Pack, confirming identity before a payment — the OTP pattern boils down to four steps:

1. Generate a 6-digit code (Code node) and store it in a Supabase table with the phone number, a 5-minute expiration timestamp, and a pending status — see our guide to connecting Supabase to n8n for the table structure.
2. Send the code by SMS via the Twilio node, never by email for this specific use case: the whole value of an OTP comes from using a second channel, distinct from the one the request was initiated through.
3. Receive the user's input (a web form or an SMS reply via Twilio Trigger) and compare it against the stored code, checking the expiration.
4. Invalidate the code after a successful check or after a limited number of attempts (3 tries), to prevent a brute-force attack on a 6-digit code.

Compliance: consent and the STOP opt-out

A phone number is personal data just like an email address — the principles covered in our guide on handling GDPR requests apply in full. For any commercial or promotional SMS, French law requires a STOP opt-out mention (Article L34-5 of the French Postal and Electronic Communications Code) — purely transactional SMS (an OTP code, confirming an appointment already booked) are generally exempt, but prior consent to receive SMS remains best practice in every case. If you already keep a GDPR audit trail in Supabase, log each SMS send there too (recipient, date, content) alongside your other automated processing.

Common pitfalls

• A badly formatted number. Twilio silently rejects a number that isn't in full E.164 format; validate and normalize systematically upstream, especially if the number comes from a free-text form field.
• Cost creeping up unnoticed. Unlike an LLM call at a few cents, every SMS has a fixed per-unit cost multiplied by volume; add this line item to your usual tracking of AI call costs in n8n rather than discovering it on the monthly Twilio bill.
• Ignoring Twilio's rate limits. A bulk send (reminding hundreds of files in a single execution) can hit Twilio's API rate limits; the retry-with-backoff principle described in our guide on 429 errors and rate limits applies to Twilio just as much as to the OpenAI or Anthropic APIs.

Going further

SMS via Twilio isn't a node shipped natively in the FlowKit packs, but it wires up in a few minutes on top of the alert workflows in the Inbox AI Pack (€79) and the reminders in the Compliance & Audit Pack (€149), alongside the Slack and email channels already in place. If your priority is actually making those reminders and that traceability solid before adding another channel, the Complete FlowKit Bundle (€269) brings all three packs together on that same foundation.