Key Takeaways
- n8n Android SMS gateway patterns should verify HMAC on inbound webhooks, then call REST send with a least-privilege key from n8n credentials — not a chat-pasted secret.
- Idempotent workflows: at-least-once delivery means dedupe on message id / event id before side effects.
- Isolate OTP workflows from marketing blasts on device pools.
- OEM + plan caps still apply; no Unlimited SMS titles.
- Developer Center owns live REST fields; no official n8n marketplace plugin required.
- BYO Android and operator credit. We meter devices and volume (Free 300 lifetime; paid from $19/mo).
Summary
An n8n Android SMS gateway webhook pattern is HMAC verify → durable dedupe → HTTP send to the gateway REST API. Hub: Android SMS Gateway API. Webhooks: webhook overview. Docs: Developer Center. n8n: n8n docs.
A workflow that sends SMS before verifying the webhook is not automation. It is an open relay with a flowchart.
Webhook-first pattern
Gateway events (delivered, failed, inbound) POST to your n8n webhook URL. Verify signature on the raw body, persist the event id, then branch. Outbound alerts use HTTP Request with credentials — not hardcoded keys in node parameters committed to git. How the gateway works.
Context
Teams wire “HTTP → Send SMS” for every CRM update and discover retries doubled messages. Design for at-least-once delivery and device offline queues from day one.
Build the n8n path
- Pair the phone and confirm last-seen healthy via setup.
- Store API key + webhook secret in n8n credentials.
- Webhook node: verify HMAC, reject on mismatch.
- Dedupe on event/message id before CRM or notify side effects.
- HTTP send node: JSON body per Developer Center; idempotency key for OTP/alerts.
Node responsibility table
| Node | Job | Fail closed if… |
|---|---|---|
| Webhook | Receive + HMAC | Signature missing/invalid |
| Dedupe / DB | Persist event id | Duplicate replay |
| IF / Switch | Route OTP vs alert vs ignore | Marketing path hits OTP pool |
| HTTP Request | REST send | Key in plaintext node JSON |
Automation still meters SMS
Each accepted send meters devices/volume and spends operator credit. Failed workflow retries can burn airtime — budget for them. Free/Developer pause when allowance is exhausted. Pricing.
Operations
Monitor n8n execution errors and gateway Pending age. Canary on staff numbers before customer OTP. After OEM updates, re-test the critical path.
HMAC and least privilege
Use a send-scoped key for outbound nodes; do not reuse admin tokens. Constant-time compare on webhook MACs. Never log full SMS bodies in n8n execution data for OTP.
Decision guide
Prefer n8n for ops alerts and consented transactional pings. Keep login OTP verification in your app backend — see OTP use case.
Checklist
- HMAC before side effects.
- Credentials vaulted; idempotent sends.
- OTP devices isolated from campaigns.
- OEM + plan caps documented in pacing.
- No Unlimited SMS titles; no exploit PoCs.
Next steps
Node OTP send pattern: Node.js send OTP via API.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS webhook integrationInbound and status events
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
