I have an Twilio programmable messaging app which is deployed in a Twilio serverless environment.

let response = new Twilio.Response();
exports.handler = async function(context, event, callback) {

    const accountSid = context.ACCOUNT_SID
    const authToken = context.AUTH_TOKEN

    const twilioClient = context.getTwilioClient();

    const toAddress = event.to;
    const fromAddress = event.from

    var text = "something something";
    
    await twilioClient.messages
    .create({ 
      body: text, 
      to: toAddress, 
      from: fromAddress
    })
    .then(...)
    .catch(...)

    response.setStatusCode(200);

    callback(null, response);
}

Production and Development have distinct sets of environment variables that point to their own respective sandbox/production push certs

ACCOUNT_SID=ACxxx
AUTH_TOKEN=xxx
API_KEY_SID=SKxxx
API_SECRET=xxx
APP_SID=APxxx
PUSH_CREDENTIAL_SID=CRxxx
CONVERSATIONS_SID=ISxxx
APN_PUSH_CREDENTIAL_SID=CRxxx

This works perfectly in development and push notifications are triggered and sent to the relevant iOS device.

Once deployed to production and used with a TestFlight build it seems like the server context isn’t using the correct certificate credentials. I end up with the errors

• 52004 – Credential SID not specified
• 52134 – Invalid APNs device token

I know the push certificates are correct as iOS client-to-client chats work in both dev and prod and push notifications are sent and arrive as expected.

My question is, what secret sauce do I need to bind/attach the production push credential to the Twilio client when used from the serverless context.