Part Ten. Your first phone number.
Kit 9 caught an email address. That's a fine thing to own. It's also one channel, and it's the slow one. Somebody signs up on a Tuesday night, your welcome lands, and it sits in a tab with forty other tabs until the weekend, if it gets opened at all.
A phone number is the other channel. A text gets read in about three minutes, by almost everyone who gets it, and nobody has a "promotions" folder for it. So this kit gives your projects a number of their own. Not your personal cell. A number your code can send from and, this is the part people skip, receive on.
Here's what it actually opens up, because "SMS" sounds like marketing and most of what you'll use it for isn't.
A code that proves the person signing up owns the number they typed. An order update that says shipped, with a link. A heads-up to your own pocket the second a form comes in, so you can answer while they're still on the page. And an alert when your server goes quiet at 3am, from a system that noticed before you did. One number does all of it.
I use Twilio. Not because it's the only one, but because it's the one every piece of code already knows how to talk to, it starts free, and it has the same scoped-key idea you learned in Kit 6. So there's only one genuinely new thing in this kit, and it's a rule, not a technique.
The carriers changed the rules a couple of years ago. If you're a business sending texts from a normal ten-digit number in the US, you have to be registered first. They call it A2P 10DLC, which is a terrible name for a simple idea: they want to know who you're and what you send before they carry it. Unregistered traffic from a local number is blocked outright, and there's nothing you can do about that from code. Registration also needs a paid account, so the card goes on before this step.
So before you buy a number, you pick a door.
Door one is a local number, registered. You register yourself as a brand, one person without a business entity counts, then you register one campaign, which is a paragraph describing what you send and how people opt in. Twilio's current numbers are about twenty dollars once and two dollars a month for a sole proprietor, and the review takes days. Their page says five to ten right now. That's the honest timeline and you should plan around it, not fight it. One thing to know about this door: a sole proprietor brand is deliberately small, one number, one campaign, one message a second, and it's only for people without an EIN. If you have one, you register as a low-volume standard brand instead.
Door two is a toll-free number, verified. No campaign, no monthly campaign fee, and verification runs about three to five business days. The catch is that since January 31, 2024 an unverified or still-pending toll-free number can't send at all, not even a test. And a toll-free number reads as a company. That's right for order updates and codes. It's wrong for a text that's supposed to feel like it came from you.
My take: one person building their own thing takes door one and starts the paperwork tonight. A business with an EIN sending transactional texts takes door two. Door two is less paperwork, not no paperwork: you still describe the use case, the opt-in flow, your site and sample messages, and most rejections come from vague opt-in wording. Either way, the free trial lets you verify your own mobile and send a test to it, trial prefix and all. A custom text from your own new number can still wait on the door clearing. So do the paperwork first and treat the test as the last step, not the first.
Now the pieces, because there are three and only one of them is new.
The key. Twilio hands you an Account SID and an Auth Token at signup, and the Auth Token can do everything, including spend your money. You don't give that to Claude. You make a separate API key, Twilio's restricted kind, ticked to send messages and nothing else, and that's what your code uses. If it leaks you revoke that one key and the account is untouched. Same lesson as Kit 6. Least privilege isn't paranoia, it's just where you keep the blast radius.
The send. One request with a from, a to, and a body. That's the whole API for outbound. When your phone buzzes with a text from your own number, sent by your own code, you're through the hard part. In trial it'll say "sent from a Twilio trial account" on the front. That's expected and it goes away when you add a card.
The inbound endpoint, which is the piece most people never build. When somebody replies to your number, Twilio doesn't keep it. It delivers the reply to a URL you name, and if you never named one, the reply goes nowhere. So Claude adds one small endpoint on your Kit 7 server, the same shape as the Kit 9 form endpoint: Twilio posts the sender and the text, the endpoint checks the request really came from Twilio, saves it, and emails it to you through your Kit 6 domain. Every reply lands in your inbox in seconds. You now have a phone number that answers to your code and reports to you.
Two things the kit puts in from the start, because bolting them on later is how people end up as spammers with a phone bill.
Opt-out, twice. Twilio handles the legal words on standard numbers: STOP blocks the person, START lets them back in, HELP gets an automatic answer. But Twilio only stops what Twilio sees. So the kit also keeps a do-not-text list in the same SQLite file from Kit 9, writes to it on every STOP that hits your endpoint, and every send checks it first. Belt and braces, and the braces are yours.
Quiet hours. One rule in the code, yours rather than Twilio's and a notch stricter than the usual legal window: no marketing texts before nine in the morning or after eight at night in the recipient's time zone, and never more than a couple a week unless they asked for more. Codes and order updates are exempt, because they're answering something the person just did.
What it costs: a local number is about a dollar a month, toll-free a little over two, and a text is under a cent plus a small carrier fee. Registration is the only real line item and it's about the price of lunch. What you feel isn't the money. It's the first time your phone buzzes because your own code decided it should.
The honest part. What you've built is one number, one key, and about a hundred lines you understand. If you grow into needing segments and campaigns and a dashboard, there are good products for that and you should use one. What this gives you is the thing underneath all of them: a channel you own, that your projects can use, with the consent and the opt-out done right on day one, so that whatever you build on top of it later starts from a clean list.
If you want to do it, it's a copy-paste prompt. Go to connectwithcliff.com/kit, copy the Kit 10 prompt, paste it into Claude, and it walks you through the account, asks you which door, buys the number, starts the paperwork, and sends the first text to your phone in front of you. New here? Start with Kit 1 so Claude can actually run.
One more thing, and it's new to the kits from this one on. Every kit now starts with a short legend Claude reads first: what the kit assumes, and which earlier kit provides it, with the address. So if you paste Kit 10 and you never did Kit 6, Claude fetches Kit 6, does it with you, and comes back. You don't have to know the order. Claude does. The whole list, in a form Claude can read, is at connectwithcliff.com/downloads/INDEX.md.
Next part: the Kit 9 form gets an optional phone field, with a one-time code, so you only ever store a number that really belongs to the person typing it.