Key Takeaways
- “Self-hosted Android SMS gateway” almost always means you host the handset and SIM. The last mile is still GSM through your operator — you are not running a carrier SMSC in the closet.
- A maintained control plane still queues jobs and stores API keys. You trade OSS server toil for a device-plus-volume service fee. Airtime stays with the operator either way.
- Reliability is power, RF, pairing, and OEM battery policy. Brochure SLAs do not wake a phone that Doze killed.
- Use a self-hosted phone when recipients should see your real MSISDN, you already buy local airtime, and a small team can keep devices online.
- Service pricing is based on device count and total SMS sent through the gateway. You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance.
What “self-hosted” usually means
Searchers type android phone as sms gateway self hosted when they want to keep the hardware — and often the phone numbers — inside their own building. They are rarely asking to implement MAP/SS7. They want a spare Android, a local SIM, and an API that makes that SIM send. Recipients should see a number they can call back.
If nobody on the team can walk to the phone, plug it in, and tell you why it went quiet, you are not self-hosting a gateway. You are hiding a pager in a cupboard.
Hub B’s overview is Android phone as SMS gateway. This spoke stays on the self-hosted decision: what you run, what you still buy from a carrier, and when a CPaaS lane is the honest answer.
You host the radio, not an SMSC
The GSM path does not move into your rack. Your operator’s SMSC still delivers the PDU. “Self-hosted” here means:
- Physical custody of the Android device and SIM.
- Power, RF, and a network path so the app can stay registered.
- Your airtime contract — prepaid or postpaid — with that operator.
- A control plane (maintained cloud or software you operate) that queues HTTPS jobs to the phone.
SMS Gateway’s maintained path uses a cloud panel and the official APK. You still bring the phone. OSS projects can replace the panel if you want that toil; they do not replace the carrier. Read Android SMS gateway open source before you staff a weekend port of someone else’s repo.
Phone gateway vs CPaaS vs USB modem
| Self-hosted Android phone | CPaaS aggregator | USB GSM modem / AT stack | |
|---|---|---|---|
| Who sends | Your SIM, your MSISDN | Rented cloud numbers | Modem stick, often a datacenter SIM |
| You operate | Handset, power, OEM, airtime | Almost no hardware | Drivers, dongles, serial, often Linux |
| Billing shape | Devices + platform volume; airtime to carrier | Per-message + number rental | Hardware + carrier; software you patch |
| Two-way | Replies on the same SIM | Depends on number type | Possible, more moving parts |
| Global burst | Weak — add SIMs per market | Strong default | Weak unless you rack many modems |
Honest CPaaS contrast: Twilio vs Android SMS gateway. Hybrid (Android for domestic OTP, aggregator for long-tail countries) is a normal architecture, not a failure of nerve.
What you actually operate
Daily: pairing status, battery, queue depth, prepaid balance, whether last night’s OEM update reinstated battery optimization. After a SIM swap or a factory reset, re-pair and re-send a canary. Dual-SIM phones need a written slot map; “the left tray is OTP” is not documentation if the trays were swapped in a drawer.
Network: Wi-Fi for the control path is boring and good. Mobile data works. A phone that only has RF for SMS but no IP path cannot claim jobs from the panel. That distinction surprises teams who thought “self-hosted” meant “no internet.”
When a self-hosted phone wins
- Domestic OTP and alerts on a number customers already save.
- You already buy large local SMS bundles and hate aggregator margins on that traffic.
- Two-way support on a real MSISDN, not a rented code.
- A site with power and staff who can physically recover a handset.
Setup still starts with the device setup guide and the APK on downloads.
When it is the wrong tool
Zero hardware tolerance. Multi-country burst with no local SIMs. A team that cannot name an on-call owner. “Self-hosted” as a synonym for “unlimited free SMS” — that search intent is a mismatch. Carrier fair-use and OEM rate ceilings still exist. Raise Android SMS rate ceilings where the OEM allows; do not advertise them as gone.
Stand up a self-hosted path
- Decide what you are hosting. You are hosting Android radios and SIMs. Confirm whether you also want a maintained cloud panel or an OSS control plane you patch yourself.
- Pick dedicated handsets. Not a daily-driver phone. Charger, Wi-Fi, SMS-capable SIM, Android 8+ recommended.
- Install, pair, and prove one send. APK, permissions, QR pair, one API message to a staff handset, then a DLR. If that loop fails, do not talk about scale.
- Document power, RF, and on-call. Who notices a red pairing light at 02:00. Who tops up prepaid. Where the spare sits.
- Isolate OTP from bulk. Second device before you mix authentication with campaigns.
- Add monitoring. Heartbeat, battery, queue depth, DLR anomalies. A silent phone is a self-hosted outage.
API shape: HTTPS POST /api/v1/messages with Bearer auth. Confirm fields in the SMS API documentation. Webhooks and DLR: SMS webhook integration and the delivery reports guide.
The room the phone lives in
Self-hosted sounds like software. Most outages are furniture. Put the handset where staff actually walk: a shelf with a label, not a locked comms closet nobody opens on weekends. Leave a USB-C cable that is not the only cable in the building. If the site uses a generator, test that the charger stays live on transfer — cheap wall warts drop out for two seconds and some OEMs treat that as “unplug, kill background apps.”
RF: a metal cabinet, a basement next to a UPS, or a windowless concrete stairwell will make “the API is slow” tickets that are really two bars of signal. Do a five-message canary from the final mounting location, not from the desk where you unboxed the phone. If you run several devices, spread them so one microwave or one operator outage does not take the whole fleet. That is still self-hosted; it is just not naive.
Label the tray. Dual-SIM self-hosting without a written slot map is how OTP starts leaving through the prepaid tourist SIM you used for a demo. After any physical move, re-run the canary and update the panel nickname if the MSISDN changed.
Security on a box you own
Physical access is a feature and a risk. A self-hosted phone in a reception drawer can be stolen with the SIM still registered. Lock the device, restrict the Google account, keep API keys on the server, rotate them when contractors leave. Do not paste keys into tickets. Inbound OTP bodies do not belong in shared chat.
Cost without mythology
Service pricing is based on device count and total SMS sent through the gateway. You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance. Self-hosting does not waive the service fee and does not include carrier SMS. Paid plans from $19/month cover the control plane; Free is 300 SMS lifetime to prove the radio path. See device and SMS volume pricing. Staff time walking to a silent phone is part of TCO even when it never appears on a Stripe invoice.
Next steps
Read the Hub B cornerstone Android phone as SMS gateway, then the product definition on how an Android SMS gateway works. If you need more radios, continue with multi-device and dual SIM routing.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- SMS API documentationLive endpoint reference
- download the Android gateway appGet the APK





