Backbone/JS: looking to access the Twilio SMS API via an AJAX call

Question

Looking to set up Twilio's SMS service so that when a user presses a certain button, it leverages my account with Twilio to send a text.

Using Backbone.js with coffeescript, and this has to be done client-side for the moment, so I'm doing something like this:

events: {
        "click .button": "sendText"
}

and then sendText looks like this:

sendText: ()->
    accountSid = '{my account sid}'
    authToken = '{my auth token}'
    ToNumber = "{string of a number to text to}"
    FromNumber = "{string of my Twilio number}"
    Body = escape("Hey, this is working.")

    myJSONData = "To=%2B1" + ToNumber + ", From=%2B1" + FromNumber + ", Body=" + Body

    $.ajax({
                type: 'POST',
                url: 'https://api.twilio.com/2010-04-01/Accounts/'+ accountSid + '/SMS/Messages',
                data: myJSONData,
                success: (data) -> {
                    console.log('SMS sent successfully!')
                }
        })

Is this heading in the right direction? I know that I haven't entered my auth credentials anywhere yet, but I'm not certain where to do that yet.

Answer 1

You shouldn't, under any circumstance, have your authToken (and the situation is worse as you're also including your account sid) available for anyone who wants to see you source code.

With that info, I can provision numbers on your behalf, make calls, return numbers... You just can't do it on the client side.

You should connect (using Ajax if you want) to your server, which in turn would connect to twilio passing your credentials. That way, the only one who knows them is your server.