Key Takeaways
- Android SMS gateway server authentication models are three doors: dashboard login, API Bearer, device pairing. Mixing them is how keys leak into APKs.
- Public send is Authorization: Bearer on POST /messages. No ?key=, no email/password on the API.
- Webhook HMAC is inbound authenticity, not a substitute for the send key.
- Keys live in env on your server. Dashboard shows a secret once — treat rotation as a drill.
- Service pricing is based on device count and total SMS sent through the gateway. You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance.
Android SMS gateway server authentication models are Hub F plumbing: who may enqueue a send, who may pair a handset, and who may post a delivery event at you. This is not the architecture cornerstone and not a dual-SIM essay.
Service pricing is based on device count and total SMS sent through the gateway. Overview: server guide. Contract: API docs. Keys: dashboard.
If the SPA can send SMS, you do not have an authentication model. You have a public pager.
Three different auths
Humans sign into the panel. Services send Bearer JSON. Phones pair as devices. Collapse those and you either paste a key into a client bundle or you let a stolen phone mint traffic with your plan. Production-readiness.
Auth table
| Door | Credential | Wrong move |
|---|---|---|
| Dashboard | User session | Sharing one login across vendors |
| Send API | Authorization: Bearer | ?key=, basic auth, key in APK |
| Device | Pairing / device record | Treating pairing as the send secret |
| Webhooks in | HMAC signature header | Open POST URL, no verify |
Bearer on every request
Runnable send shape (docs win if this drifts):
curl -X POST "https://app.sms-gateway.app/api/v1/messages" \
-H "Authorization: Bearer $SMS_GATEWAY_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: 3f1b0c8a-9d2e-4c77-9f5a-2b6d1e0f4a83" \
-d '{"to":["+14155552671"],"text":"Your verification code is 481920","type":"sms"}'Rotate keys in env. Do not commit them. Idempotency is not auth — it stops duplicate SMS after a timeout.
Device pairing is not the API key
You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance. Pair via downloads / setup. A paired phone can send only as the control plane allows. It must not carry the customer API secret.
HMAC inbound
Verify X-SmsGateway-Signature (see OpenAPI). Dedupe on event id. Webhooks.
Checklist
- Send key only on the server.
- No query-string auth in new code.
- Webhook signature test (tamper fails).
- Key rotation drill documented.
- Least privilege: OTP worker key ≠ blast laptop.
Next steps
Steal your own key from a staging SPA (you should find nothing), then send a canary OTP. Security / trust.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- download the Android gateway appGet the APK
