Key Takeaways
- Secure API keys in env for Android SMS gateway projects: never commit Bearer tokens; load them at process start from a secret store.
- Open GitHub samples should use placeholders — real keys belong in CI secrets or a vault.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. A leaked key can spend your plan volume and operator airtime.
- Free 300 SMS lifetime is not a sandbox for public gists with live keys.
- Rotate on staff change and on any paste into chat/MCP.
- Developer Center shows how to create keys — this page is hygiene.
How to secure API keys in env when your GitHub repo talks to an Android SMS gateway: treat the Bearer token like a password that can send SMS on your SIM. Related: core secure-keys how-to. MCP auth. OWASP hard-coded secrets.
Priced by devices and SMS send volume. You use your own phone and operator SMS credit.
A README that says
export SMS_GATEWAY_API_KEY=sk_live_…is a billable incident, not a quick start.
Env files and secret stores
Local: .env gitignored. Prod: platform secrets. Create/rotate keys in the control plane; confirm usage patterns in Developer Center.
Where keys leak
| Surface | Risk | Mitigation |
|---|---|---|
| Git commit / gist | Public scrape | gitignore + secret scanning |
| CI logs | Echoed env | Masked variables |
| MCP / chat | Transcript retention | Tool loads env; never paste |
| Client apps | Extractable | Server-side only |
Rotation and least privilege
Separate keys per environment and workload (OTP vs bulk). Revoke on offboarding. Pair with GDPR-minded handling.
CI and open-source repos
Example workflows inject secrets; sample code uses process.env.SMS_GATEWAY_API_KEY. Add .env.example with empty values only.
Runtime vs agent prompts
MCP wrappers and n8n credentials must read secrets from the host — not from the LLM context. See MCP auth concepts.
Related reading
Checklist
- .env gitignored; example file empty.
- Secret scanning on.
- Prod keys in vault/platform.
- No keys in mobile clients.
- Rotation runbook exists.
- Volume anomaly alerts considered.
Next steps
Rotate any demo keys, then operate within devices + SMS volume on your own Android and carrier credit.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- download the Android gateway appGet the APK
