Provider secrets stay server-side. An Apex administrator verifies sending identities, inbound routes, webhook signatures and test receipts before enabling a live channel.
How inbound texts are matched
When Twilio posts an inbound message, Apex finds the workspace by the receiving number and the applicant by the sending number. If the sender is unknown, the message is stored in the inbox as unmatched so a recruiter can link it to a record or ignore it.
Security
Do not copy provider credentials into client-facing forms or chat. Ask the Apex administrator to confirm encrypted storage and webhook verification for the active deployment.