Twilio SMS Notifications Addon for CS-Cart

Twilio SMS Notifications sends your customers an SMS when something happens to their order, through your own Twilio account. A new order, a status change, a shipment with a tracking number, a profile update, a product running low - each is a switch you turn on, with a message you write yourself.

Your account, not a reseller's

The store talks to Twilio's own API with credentials you create. Your account, Twilio's own prices, every country Twilio reaches. Nothing is relayed through Softcrafter and no message leaves your store for anywhere else.

Six events, and you decide who hears about each one

• New order, order status change, shipment created or updated, customer profile update, low stock - each switched on separately.
• Manual send from the order screen, always available.
• Three possible recipients per event: the customer, the vendor whose products are in the order, and one administrator number. Turning an event on without choosing a recipient sends nothing - a switch that picks its own audience is how a store surprises its own customers.

Your own wording, per event and per language

Placeholders are checked against the event as you save: [tracking_number] in a "new order" template is refused, because at that moment there is no shipment and it would have rendered as nothing. Customers get the text in their own storefront language, falling back to the store default.

And empty values do not leave debris. A line whose placeholders are all empty is dropped, and a label stranded by an empty value goes with it - so one template is safe for orders that do and do not carry every field, instead of sending a dangling "Carrier:" with a blank line under it.

A real queue, so checkout never waits on Twilio

Nothing is sent inside the request that caused it. The event writes a row and returns; a cron run picks it up. A Twilio timeout cannot make placing an order hang, and an outage delays messages instead of losing them. A ready-made cron line is generated for you, and the endpoint is disabled outright unless you set a secret - an unauthenticated queue runner is a way for a stranger to spend your Twilio balance.

Errors are separated, so failures are not repeated forever

• Configuration - bad credentials, a sender you do not own, a country you have not enabled: never retried, because it will fail identically forever. The log says what to fix, in words.
• Recipient - not a mobile, unreachable, blocked, replied STOP: never retried. The number will not become valid.
• Transient - rate limit, a 500 from the API, a timeout: retried with backoff, up to the limit you set.

Delivery, not just dispatch

Twilio accepting a message means it was queued, not that a phone received it. Delivery receipts come back as callbacks and the log moves each row to its final state. Every callback is verified against the X-Twilio-Signature header - an HMAC over the URL and the sorted parameters, keyed with your own Auth Token. Without that check, anyone who learned the URL could mark any message delivered and the log would agree with them.

One Turkish character can double the bill, and the screen says so

SMS is billed per segment: 160 characters in GSM-7, 70 in Unicode, and one character outside GSM-7 moves the whole message. The GSM-7 alphabet contains ö Ö ü Ü Ç and does not contain ş Ş ğ Ğ ı İ ç. The template editor counts as you type - the alphabet, the segment count, the characters responsible, and what the same text would cost without them. It never rewrites your words; that is your brand's voice, not an add-on's decision.

The record, and a health screen that states the obvious

• Every message with its recipient, event, order, state, segment count and what Twilio said; filter by state, event, phone or date.
• A per-message timeline: queued, attempted, accepted, then each delivery receipt as it arrived, with timestamps and the Twilio error explained in words.
• Resend a failed message as a new attempt, keeping the original row as the record.
• An Overview screen that reports whether credentials are valid, whether the queue is moving, whether the cron secret is set, whether any user group actually holds the privileges, and which failures are configuration rather than bad luck.

Installing

• One package for Ultimate, Multi-Vendor and Multi-Vendor Plus.
• Upgrading in place completes itself: the add-on brings its own tables, columns, indexes and privileges up to date on the first request after the files change. No remove-and-reinstall, which would delete your message history.
• Your Auth Token is encrypted with a key derived from the installation's own security hash and is write-only in the interface; the field shows only that a token is present.
• Full interface and documentation in English and Turkish.

Requirements

• A Twilio account - trial or paid - and a sender: a Twilio number with SMS capability, an alphanumeric Sender ID where your country permits one, or a Messaging Service SID.
• One cron entry, every five minutes.
• A publicly reachable HTTPS address, for delivery receipts only. Everything else works without it.
• CS-Cart 4.19.0 or newer, PHP 7.4 or newer with curl and openssl.

Known limits, said before you buy

• Twilio only. No other gateway, and no "provider" dropdown that would make every one of them shallow.
• No inbound SMS and no two-way conversations. Replies land in your Twilio console.
• No marketing campaigns and no recipient lists. This sends transactional messages about events in the store. Bulk promotional SMS is a different product and, in most countries, a different legal obligation.
• No one-time passwords. Verification is a separate add-on, Twilio Phone Verification.
• No İYS integration. If you send commercial messages in Turkey, İYS consent management remains your obligation.
• No WhatsApp and no voice in this add-on.
• Trial Twilio accounts reach only numbers verified in the Twilio console, and Twilio prefixes every message with its own trial notice.

Documentation: docs.softcrafter.dev/twilio-sms · Support: tech@softcrafter.net