Key Takeaways
- Scenario 380 is SaaS API-key rotation: inbound YES from the workspace owner before the old key dies. Not HMAC inbox, dunning retry, or seat revoke.
- If anyone on the thread can YES, you will rotate under a contractor’s phone and lock the real integration.
- Do not SMS the new secret, the old prefix, or the webhook URL. Workspace name and a short confirm token.
- Login OTP stays on another device.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Free: 1 device / 300 SMS lifetime / 300 contacts. Developer: 25,000 SMS per year.
Android SMS gateway scenario 380 is a B2B workspace leaking an old live key. Security wants it dead in an hour. The owner must YES. Webhook-secret paste and billing RETRY are the wrong list.
Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Two-way inbox · Developer Center. GSMA.
Rotate confirm, not HMAC paste
Open a 20-minute inbox window. Match YES + key-id token. Timeout pages security — do not auto-rotate on silence.
If silence equals rotate, you will break production because the owner’s phone was in a Faraday bag.
YES vs webhook secret
| Lane | Body | Inbound | Device |
|---|---|---|---|
| Key rotate | Workspace + token | Owner YES | Ops modem |
| HMAC / secret | Dashboard only | None | — |
| Login OTP | Digits | Auth | Dedicated |
Caps: 2 / 5 / 15.
Owner number only
Bind at owner, not last engineer. REST: PHP, C#. MCP wraps REST.
Never SMS the new key
Confirm token only. The secret appears once in the dashboard after YES.
Devices and airtime
Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Free: 300 lifetime. Developer: 25,000 SMS per year. Pricing.
Same-hour rotate
Audit
Log key id + inbound MSISDN + decision. Rotate keys. Not a CodeCanyon key pack.
Inbox or console
If you cannot bind an owner number, rotate in the signed console. Do not accept YES from the thread.
Checklist
- Owner MSISDN bound.
- Engineer YES ignored.
- Silence ≠ rotate.
- No secrets in templates.
- Webhook signatures.
Next steps
Send YES from a staff engineer number; prove the key stays and the audit fires. Downloads · Docs.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- two-way SMS inboxReplies on your SIM
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS webhook integrationInbound and status events
- SMS auto-reply and STOP keywordsOpt-out and keywords
