Android SMS Gateway for SaaS onboarding: Architecture

Android SMS gateway for SaaS onboarding architecture is for product teams that want signup OTP and “you’re in” texts from a local SIM they already pay for. The SPA never holds the key. The phone is a modem with OEM moods. This is not GoHighLevel-as-a-gateway and not a multi-language SDK.

Service pricing is based on device count and total SMS sent through the gateway. See OTP verification and API docs.

Onboarding OTP latency is an activation metric. Promo drip is a different queue.

Where SMS sits in the funnel

Signup creates a user and a challenge. Your API POSTs /messages. Webhooks message.delivered /message.failed update the challenge row. The client polls your API, not the gateway. NIST-style authenticator guidance is a useful overlay for code lifetime and throttling — NIST SP 800-63B — not a claim that this product is a certified IdP.

curl -X POST "https://app.sms-gateway.app/api/v1/messages" \
  -H "Authorization: Bearer $SMS_GATEWAY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 3f1b0c8a-9d2e-4c77-9f5a-2b6d1e0f4a83" \
  -d '{"to":["+14155552671"],"text":"Your verification code is 481920","type":"sms"}'

Architecture table

OTP as an activation SLO

Chart time to delivered, not “emails opened.” Isolate the OTP deviceIds from lifecycle marketing. Do not log full codes in Slack. Short expiry. Hash templates if you use Android SMS Retriever later. India / other geo TRAI rules still apply if you send there — India gateway notes.

Canary before paid device scale

Prove the path on Free (300 SMS lifetime, one device) or Developer, on staff numbers, on a cold handset in the region you sell. Then add devices for launch week. Spare charged phone on the plan. Pricing.

Onboarding drip is still marketing

“Finish setup — 10% off annual” is promo. Consent, STOP, quiet hours, not the OTP SIM. Bulk consent. You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance.

Checklist

• Key in env; SPA never sends.
• Idempotency-Key = userId + challenge id.
• OTP SIM isolated from drip.
• DLR webhook verified (X-SmsGateway-Signature).
• p95 measured on a regional cold phone.
• Canary under Free/Developer limits before extra devices.
• Codes not pasted into tickets.

Next steps

Install from downloads, send one staff OTP, then hang signup on your auth service — not on a CRM zap that holds the key.