quo

name	quo
description	Build, scaffold, and integrate Quo — formerly OpenPhone — telephony into a full-stack app: send & receive SMS/text messages, list and analyze calls (recordings, AI summaries, transcripts, voicemails), manage contacts, conversations, tasks, users, and phone numbers via the Quo REST API (https://api.quo.com/v1), plus signature-verified webhooks. Ships a one-command scaffolder that emits a runnable integration (Express + API client + send-SMS route + a signature-verifying webhook receiver), a preflight checker, a tested webhook verifier (Node + Python), and an importable client. Use whenever the user wants to add, build, or scaffold SMS/text messaging, programmatic calls, an OpenPhone or Quo integration, two-way SMS, call transcripts/summaries, contact sync, or Quo webhooks — even if they only say 'OpenPhone', 'Quo', or 'send a text from my app'. Bakes in the raw-API-key auth gotcha (no Bearer token), A2P 10DLC registration, the 202/one-recipient/E.164 send rules, and the whsec_ webhook signing scheme.
license	MIT
compatibility	Bundled scripts need Node 18+ (built-in fetch + node:crypto) and/or Python 3.8+ stdlib, plus bash + curl for preflight. Integrations target any stack that makes HTTPS calls (Node/Express, Next.js, Python, Ruby, PHP, Go); the scaffolder emits Node/Express + vanilla or React. A Quo (OpenPhone) account with workspace owner/admin is needed to generate an API key; US SMS also requires A2P 10DLC registration.
inputs	[{"name":"QUO_API_KEY","description":"Quo (OpenPhone) API key — the RAW key, sent verbatim in the Authorization header (NO 'Bearer ' prefix). Generate at Quo workspace → Settings → API (owner/admin only); each key has full account access. The legacy var OPENPHONE_API_KEY is also accepted by the bundled scripts.","required":true},{"name":"QUO_WEBHOOK_KEY","description":"Beta webhook signing secret, prefixed 'whsec_'. Returned ONLY in the POST https://api.quo.com/webhooks response (data.key) and on rotate — store it immediately. Used solely to verify inbound webhook signatures.","required":false},{"name":"QUO_BASE_URL","description":"Optional host override. Default https://api.quo.com/v1 (the canonical host per the OpenAPI servers block). https://api.openphone.com/v1 is a live, identical legacy alias.","required":false}]
metadata	{"author":"github.com/kryptobaseddev","version":"1.0.0","last_updated":"2026-06-15 17:30:00","category":"communication"}
allowed-tools	Bash Read Write Edit Glob Grep WebFetch

Quo (formerly OpenPhone) — REST API & Webhooks Integration

Add programmatic phone communications to a site or app: send and receive SMS/text messages, pull call history with AI summaries / transcripts / recordings / voicemails, manage contacts (and custom fields), conversations, tasks, users, and phone numbers, and react to events in real time via webhooks. Quo is the rebrand of OpenPhone; the two share one API.

Naming: the product is now Quo (quo.com), but the REST API, the OpenAPI spec, and most existing integrations are unchanged from OpenPhone. The canonical host is https://api.quo.com/v1; https://api.openphone.com/v1 is a live, byte-identical legacy alias (both verified). Pick one and keep it in a single configurable constant.

Facts that prevent broken work

Read this table first — each row is a real failure integrators hit.

Fact	Consequence
Auth is the RAW API key in the Authorization header. The docs say verbatim "The Quo API does not use a Bearer token."	Authorization: Bearer <key> → 401 Unauthorized. Send the key value alone: Authorization: <key>.
Base URL is https://api.quo.com/v1 (OpenAPI servers); https://api.openphone.com/v1 is an identical alias	Hardcoding one host is fine, but don't mix /v1 REST with the un-prefixed beta webhook host (https://api.quo.com/webhooks, no /v1).
Sending SMS to US numbers requires A2P 10DLC carrier registration	Without it, POST /v1/messages returns 400 code 0206400 "A2P Registration Not Approved" — a 400 here is NOT a malformed body.
Send is async and returns 202, not 200	Treat 202 as . must be E.164 recipient ( — no fan-out per call); is 1–1600 non-whitespace chars; .