Key Takeaways
- mcp auth and api keys android sms gateway: the MCP server holds the Bearer in env/vault. The agent never sees the key.
- This is a REST wrapper you run — not a first-party Cursor or Claude plugin we sell.
- Same rules as /blog/core-android-sms-gateway-how-to-secure-api-keys-in-env.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit.
- Free 300 SMS lifetime is enough to notice a stolen canary from a chat log.
- Do not paste Authorization headers into MCP tool traces.
In-depth MCP auth and API keys for an Android SMS gateway is the same secret problem as any worker, with a worse screenshot culture. Sibling: keys in env. Overview: building an SMS MCP server. MCP specification.
Priced by devices and SMS send volume. You use your own phone and operator SMS credit.
If the tool trace prints
Authorization: Bearer, you do not have MCP auth. You have a pastebin with extra steps.
MCP wraps REST — it is not a plugin SKU
Tools call Developer Center HTTPS. We do not ship a first-party Cursor/Claude marketplace plugin.
Where the Bearer may live
| Place | OK? | Why |
|---|---|---|
| Host env / vault | Yes | Rotatable; not in the transcript |
| Local mcp config gitignored | Maybe | Still rotate; never commit |
| Agent chat / tool output | No | Logged, shared, trained-on |
| Android APK | No | Extractable send-as-you |
Host env, not the agent chat
Least privilege per environment. Staging keys do not send production OTP.
Rotate like any other key
After contractors. After a leaked trace. Canary a staff SMS after rotation.
Agents still leak OTP bodies
Redact text in tool results. OTP.
Related spokes
Checklist
- Key not in git.
- Tool logs redacted.
- Not branded as our plugin.
- Rotation runbook exists.
- APK cannot call send.
- Docs checked the same day.
Next steps
Put the key in env, then pair the phone. Devices + volume.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- download the Android gateway appGet the APK
