Key Takeaways
- Securing Laravel SMS gateway API keys means env / secret store, never the repo, never the Vite bundle, never a log line.
- There is no official Laravel SDK to hide the key inside. Http::withToken reads env. Confirm URLs in Developer Center.
- Queue workers must see the same env as the web process after config:cache.
- Staging and production keys are different. A leaked staging key still spends operator airtime on a paired phone.
- You bring the Android and carrier credit. We meter devices and send volume.
Laravel / Frameworks: How to secure API keys in env is the credential half of setup. Set up Laravel SMS gateway · API in-depth. Live send URL: Developer Center. Laravel env docs: configuration.
You bring the phone and airtime. Devices and send volume.
If grep can find the Bearer token, so can a zip of the repo.
The key never rides in git
A Laravel SMS gateway key is a production credential. Treat it like a database password. REST from Http — not a Composer “Complete SDK.”
Screenshots in Slack are backups for attackers. Rotate after every “can you paste the key.”
How to secure gateway keys in env
- Create the key in the control plane. Copy once into the secret store.
SMS_GATEWAY_API_KEY=in server env.config('services.sms_gateway.key')in code.- Webhook secret in a second env var. HMAC needs it — see webhook verify.
- Restart PHP-FPM and
queue:workafter deploy. - Canary a staff number. Revoke anything that ever hit git history.
Safe vs leaky
| Place | OK? | Why |
|---|---|---|
| Server env / vault | Yes | Runtime only |
.env gitignored locally | Dev only | Do not copy to prod by hand forever |
VITE_* / public JS | Never | Ships to the browser |
| CI logs / dump($request) | Never | Bearer in plaintext |
| Mobile app hardcode | Never | APK is not a secret store |
VITE_ is a public hole
Anything exposed to Inertia/Vue is public. The Android app on the shelf does not need your API key — your Laravel worker does. Pairing uses the panel, not the Bearer token in the phone UI.
Config cache and workers
config:cache snapshots env. Horizon workers started last week still hold the old key in memory until restart. OTP jobs then 401 while web looks fine.
Rotate without dual-sending
Keep Idempotency-Key as the order/challenge id so retries after rotation do not duplicate bubbles. Retry policies. GDPR overlap: data handling.
Next steps
grep the repo for sk_ and Bearer. Then canary. Install the Android app. 300 lifetime SMS is enough to prove the new key — not a reason to leave the old one live.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- PHP REST send samplesPHP code examples
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
