Key Takeaways
- Open-source Android SMS gateways on GitHub are other people’s control planes. This checklist is how you decide if a repo is production-shaped — not a claim that SMS Gateway is that repo.
- Stars are not a DLR SLA. Score last commit, pairing docs, signed webhooks, and OEM battery notes.
- MIT does not include operator airtime. You still BYO Android and carrier credit.
- If nobody will patch the relay at 2am, you are not production-ready. You are demo-ready.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Maintained SaaS is the same radios with a hosted plane.
This is not our GitHub
Cornerstone: Android SMS gateway open source. Relay spoke: multi-device cloud relay explained. GitHub is a forge: GitHub. Maintained API: Developer Center.
A pinned README screenshot is not production. A pairing light that survives Tuesday is.
Readiness checklist
| Item | Ready | Not ready |
|---|---|---|
| Auth | Rotating tokens, least privilege | API key in the README |
| Webhooks | HMAC, idempotent | HTTP, no signature |
| Phones | OEM exemptions documented | “Just install the APK” |
| DLR | Unknown timeout policy | 201 = delivered |
| License | Compatible, no surprise CLA | Unclear, copyleft surprise in prod |
| On-call | Named human | Abandoned issues |
Tokens, webhooks, license
Rotate after contractors. Signed callbacks: webhook troubleshooting. License trade-offs have their own OSS spoke — do not ship GPL into a proprietary core by accident.
Score a repo before OTP
- Open the cornerstone first. Do not treat this checklist as the whole OSS buyer’s guide.
- Check commit and issue hygiene. Last meaningful commit, pairing bugs, DLR tickets. GitHub is a forge, not a warranty.
- Demand signed webhooks and idempotency. Unsigned inbound is a forge. Duplicate jobs burn airtime.
- Read battery and OEM docs. If they are missing, OTP will die overnight. You will write those docs yourself.
- Drill token rotation and a dead phone. Time to restore login codes. If it is hours, it is not ready.
- Compare staff time to maintained. Honest TCO includes VPS, TLS, and a human.
Setup physics still apply on DIY: device setup. OTP: OTP verification.
When maintained wins
Zero appetite for relay patches, need DLR history and device caps that finance understands. Contrast: Twilio vs Android. Docs for us: SMS API documentation.
True cost
Service pricing is based on device count and total SMS sent through the gateway. You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance. OSS still needs VPS and airtime. Maintained from $19/month; Free 300 SMS lifetime to canary. Device and SMS volume pricing.
Next steps
Tick commits, HMAC, OEM docs, then a dead-phone drill. If that feels heavy, you already have the maintained answer.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- download the Android gateway appGet the APK




