Android Sms Gateway Api Self Hosted: In-Depth Guide

What people mean by self-hosted

Search for “android sms gateway api self hosted” mixes three architectures. One is an open-source SMSC on a VPS (Jasmin, Kannel, PlaySMS). One is “run an app on my phone and POST JSON from my backend.” One is a fantasy: a private copy of a SaaS API in your rack, with no phones.

SMS Gateway (this product) is the second. You host the modem. We host the queue, accounts, and REST API. If you came here expecting a Docker Compose that speaks SMPP to an operator interconnect, you are shopping a different category. Say that out loud before you buy either.

Service pricing is devices plus send volume. You bring the Android and operator SMS credit. Free is 300 SMS lifetime. We do not refund airtime.

What this product actually hosts

Control plane: signup, API keys, device registry, job queue, dashboard — at the hosted app. Android app: claims jobs, talks to the radio, reports status. Your backend: HTTPS with Bearer token. Recipients see the SIM number. Product overview.

“Self-hosted, here, means the transmitter lives in a cupboard you unlock. It does not mean you cloned the API into your VPC and called it on-prem CPaaS.”

Custom branding exists as contracted work, not as a white-label “sell SMS as a business” appliance. Sending still bills on devices and volume.

Radio on-prem, API in the cloud

Stack comparison

Jasmin, Kannel, Gammu

Those projects are real. Jasmin is a widely used open-source gateway; its docs live at docs.jasminsms.com. Kannel and Gammu sit closer to the modem/SMPP end. They are excellent when you have interconnects and people who enjoy running SMSC software.

They are a poor substitute if all you wanted was “POST JSON, my phone sends.” You would still need a modem farm, or you would still be an aggregator. Do not install Jasmin expecting it to drive an unattended Pixel without extra glue.

Conversely, do not expect SMS Gateway to terminate SMPP from your carrier. The Android is the interconnect.

Using the API as if you owned the modem

From your VPC, the API is just HTTPS. Keep keys in env. Idempotency for OTP. Webhooks into a URL you do host — that part is self-hosted: your receiver. Webhook integration. Verify signatures. Retry with backoff. Do not poll by sending again.

Samples: PHP, C#. Not Composer/NuGet products. Python/Node teams write the same JSON.

Device routing: omit device ids for the primary; pass them to split load. Multi-device. Throughput is still radio physics.

What you still operate

• Physical phones or tablets, Android 8+ recommended, SMS-capable SIMs (not data-only).
• Power, cooling, and a network path so the app stays registered after reboot.
• OEM battery restrictions — a “self-hosted modem” that sleeps is a hosted outage.
• Airtime top-ups. The API will not notice a zero balance until sends fail.
• Consent and STOP. Transport is the gateway; law is yours. STOP / auto-reply.

If that list looks worse than paying CPaaS, believe the list. Comparison. If it looks like work you already do for field devices, you are the buyer.

Network path, not inbound ports

The phone needs outbound connectivity to the control plane. It does not need a public IPv4, a VPN into your VPC, or NAT hairpins for every send. Your backend needs outbound HTTPS to the API, and your webhook receiver needs an inbound URL we can reach (or a tunnel you operate).

Teams who “self-host” by putting the phone on a locked-down IoT VLAN often forget DNS, TLS time, and OEM update windows. If the app cannot stay registered, you hosted a brick. Allowlist what the vendor documents; do not invent SMPP ports.

Webhook self-hosting is the part that looks like classic ops: TLS certs, replay protection, idempotent consumers, DLQ. That is your estate. The radio remains a phone.

Where data sits

Message metadata in the cloud control plane, subject to plan retention. Copies on the Android SMS store unless you lock the handset down. Copies at the operator because that is how GSM works. If a policy says “no message bodies on mobile devices,” a SIM gateway is the wrong product. Use CPaaS or do not send SMS.

API keys stay on your servers. The APK is paired to an account, not given a wildcard token in a Slack channel. Rotate on staff change. Self-hosting the phone is not an excuse to paste secrets into the device notes app.

Scaling the self-hosted radio

Scale is more handsets, not a bigger VM. Dual SIM helps when one operator flakes; it does not double physics if both slots share a radio. Peak OTP on a Monday morning is a device-count problem. Average load is a vanity metric.

Spare units, charged, paired, sitting on the same desk, are the HA story. Cold spare that nobody paired is a prop. Drill failover the way you drill database failover — with a timer, not a slide.

If you outgrow a cupboard of phones, you are either an aggregator (buy CPaaS) or you are building an SMSC (buy people who have done it). The hosted API plus Android fleet is the middle: real MSISDN, real airtime, finite ops. Stay in the middle on purpose.

Next steps

Pair one phone via setup, send from your server, point a webhook at a URL you control. That is the self-hosted radio path. Plans: pricing. Download the APK from the site when you are ready to host the modem — not a second API cluster.