Key Takeaways
- Gateway server how to secure API keys in env: the control-plane Bearer token belongs in systemd EnvironmentFile, Docker secrets, or a vault — not docker-compose committed to git.
- Hub F cornerstone is the server guide. Hub C sibling is the API client key how-to. Different process, same blast radius.
- The Android app is a paired radio, not a place to paste the dashboard token.
- Staging and production relays must not share keys. Job payloads must not carry the secret.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. A leak spends every SIM on that account and the platform volume meter.
- PHP/C#/Go pages are REST samples, not a packaged SDK that “hides” the key.
Hub F: android sms gateway server how to secure api keys in env. The relay authenticates to the control plane and accepts your send traffic. That credential is as powerful as the dashboard. Cornerstone: Android SMS gateway server. Client-side sibling: API how-to on keys. App cousin: app how-to on keys.
Priced by devices and SMS send volume. You use your own phone and operator SMS credit.
If docker-compose.yml has the Bearer token, last week’s GitHub Action cache already mailed it to a fork.
The key lives on the VPS, not the phone
Pairing binds a device. The server key binds an account. Do not mix them. Local HTTP demos die when you paste the same secret into a public repo “just for the LAN.” Authentication models.
Places the relay key leaks
- Committed compose files and Helm values.
- Support zip of “full logs” with Authorization headers.
- World-readable
/etccopies. - CI echo of env in a failed job.
Env table: systemd, Docker, the laptop
| Host | Put the value | Do not |
|---|---|---|
| systemd | EnvironmentFile with 0600 | Drop it in a public unit file |
| Docker / Compose | Secrets or runtime -e | Commit the compose env block |
| Laptop debug | direnv / user secret, gitignored | Slack yourself the prod token |
| CI deploy | Masked store → runtime | Print env on failure |
| Android | Official pairing only | Bake the server token in the APK |
GDPR adjacency if logs captured the header: GDPR-minded data handling.
Rotation when the host is rebuilt
New VPS, new key, revoke the old one. People leaving, same drill. Confirm rotation steps in Developer Center — this page is ops hygiene, not an OpenAPI dump.
Not the same as APK secrets
Device pairing tokens are not dashboard Bearer tokens. Mixing them in one wiki page is how someone pastes prod into a sideloaded zip.
Samples are not a secrets manager
PHP and C# are REST JSON examples. They do not hide keys. Go bulk loops use the same HTTPS contract — not a Go SDK product.
A leaked server key spends the fleet
Priced by devices and SMS send volume. You use your own phone and operator SMS credit. One token can queue against every paired device on the account. Operator airtime is yours. Platform volume counts. Rotate first, argue later. We refund plan fees, not SIM tariffs.
Checklist
- Real values gitignored.
- .env.example is names only.
- 0600 EnvironmentFile or equivalent.
- Prod ≠ staging keys.
- No Authorization in log export.
- Rotate on rebuild and offboarding.
- APK is not a key store.
- Developer Center for live auth headers.
- No SDK theatre on samples.
- Incident: revoke, then inspect last-seen.
Next steps
Read authentication models and pricing. The phone sends. The env file decides who is allowed to ask it to.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- download the Android gateway appGet the APK
