Key Takeaways
- MCP auth failures are almost always the HTTPS token: missing env, 401, or a key pasted into chat. The protocol is a REST wrapper — not a first-party Cursor or Claude plugin.
- A connected MCP session is not a charged SIM. 401 is control-plane; empty inbox is radio.
- Least-privilege keys. Staging for agents. Rotate if a token hit Slack or Composer.
- Confirm live auth headers in Developer Center. This page is ops, not an exploit write-up.
- You bring the Android and operator credit. Platform pricing is devices plus send volume.
mcp for sms auth failures look like tool errors and feel like radio. Concepts: MCP for SMS. Overview: SMS MCP overview. Keys in the app: env. Spec: MCP.
Live headers: Developer Center. Pricing: devices and send volume. Setup twins: Cursor, Claude Desktop.
Bearer · process env · never chat
SMS_GATEWAY_API_KEY
If the model can print it, rotate it.
The token is REST, not MCP magic
MCP does not mint gateway credentials. It forwards yours. MCP vs REST. Pair the APK separately: Downloads.
A 401 after “MCP connected” means the adapter is alive and the secret is not. Do not factory-reset the phone first.
Auth failure table
| Symptom | Layer | Check |
|---|---|---|
| 401 / unauthorized | REST token | Env on the server process; live header name |
| Tools listed, send fails | Handshake vs auth | Token present at spawn, not only in the IDE UI |
| Works in curl, fails in MCP | Env inheritance | Desktop/Cursor spawn env vs your shell |
| 200 then empty inbox | Radio | Pairing, Doze, prepaid — not the key |
| Key in a transcript | Secret hygiene | Rotate; never paste into tickets |
Env did not follow the process
Curl first: curl. Then spawn MCP with the same env. HMAC on webhooks is a different secret — do not reuse the send token as a “signature key” unless Developer Center says so.
Keys in the thread
Agents will echo secrets if the tool schema allows it. Least privilege. Securing tools. Messaging practices.
Next steps
Prove 401 vs radio with one curl canary. Spend 300 lifetime SMS after auth works — then a funded SIM. Logging: MCP logging failures.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- download the Android gateway appGet the APK
