Key Takeaways
- core android sms gateway how-to secure API keys in env: getenv / vault, never the APK, never the repo, never a Postman team dump.
- Sibling: /blog/android-app-how-to-secure-api-keys-in-env. This core spoke is the product-path habits.
- Auth is Authorization: Bearer. No query-string keys from old send.php copies.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. A leaked key still spends your operator SMS.
- Free 300 SMS lifetime is enough to notice a stolen canary.
- Rotate after contractors. Least privilege per environment.
Core how-tos on securing API keys in env for an Android SMS gateway exist because keys keep landing in git. App-spoke: keys in env. curl canary: curl send OTP.
Priced by devices and SMS send volume. You use your own phone and operator SMS credit.
If the production Bearer is in a screenshot on Discord, you do not have an env strategy. You have a rotation drill you have not run yet.
The key never ships in git
.env locally, vault in prod, .gitignore actually listed. Pre-commit scanners help; they do not forgive a force-push of history.
Where keys rot
| Place | OK? | Why |
|---|---|---|
| Server env / secret manager | Yes | Rotatable, not in the artifact |
| CI secret store | Yes, masked | Still rotate; no fork PRs from untrusted |
| Committed config | No | Public the moment the repo is |
| Android APK / frontend | No | Extractable; anyone can send as you |
| Shared Postman workspace | No | Import OpenAPI; key stays local |
Bearer, not ?key=
POST /messages. Docs. No invented hosts.
Rotate after people leave
Separate keys per env. Revoke the old one after the new one works. Canary a staff OTP after rotation.
curl and CI are still secrets
Shell history and GitHub Actions logs leak -H Authorization. Use env vars, mask logs, do not echo.
Not a packaged SDK secret file
PHP/C# pages are REST samples, not composer/NuGet products that magically hide keys.
Checklist
- No keys in git history you still use.
- Prod ≠ staging keys.
- APK cannot call the send API as the company.
- Rotation runbook exists.
- Webhook secret stored the same way.
- GDPR logs do not include the Bearer.
Next steps
Rotate once as a drill, then send a staff canary. Devices + volume.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- download the Android gateway appGet the APK
