Turn Your Android Phone into an SMS Gateway with HTTPSMS and a Simple HTTP API

Overview

HTTPSMS is an open‑source SMS gateway that turns an Android phone into a software‑defined SMS endpoint. A Go + Fiber HTTP API receives requests, pushes them to a queue, notifies the Android app via Firebase Cloud Messaging (FCM), and the app sends SMS through the Android SMS API.

Architecture

┌─────────────────────────────────────────────────────┐
│               Your Application/Script               │
│          Call HTTP API: /v1/messages/send           │
└──────────────────────┬──────────────────────────────┘
                       │ HTTP 202 Accepted
                       ▼
┌─────────────────────────────────────────────────────┐
│          httpSMS API (Go + Fiber)                   │
│  - Receive request → push to Push Queue            │
│  - Async processing → notify Android App via FCM   │
│  - Return status to caller                         │
└──────────────────────┬──────────────────────────────┘
                       │ Firebase Cloud Messaging
                       ▼
┌─────────────────────────────────────────────────────┐
│          Android App (Kotlin + Material)          │
│  - Receive FCM push                                 │
│  - Call Android SMS API to send message             │
│  - Return send result to API                         │
│  - Forward received SMS to Webhook                  │
└─────────────────────────────────────────────────────┘

Message sending flow

User calls /v1/messages/send API.

API pushes a notification to the queue.

API immediately returns 202 Accepted.

Queue asynchronously triggers an FCM push to the Android phone.

Android app receives the push and invokes the Android SMS API.

Android app returns the send result.

Android app sends a delivery report.

Key design

The API replies with 202 instantly; the actual SMS transmission happens asynchronously, preventing request blocking.

Quick start

HTTPSMS can be self‑hosted with Docker.

API usage examples

Go SDK

import "github.com/NdoleStudio/httpsms-go"

client := htpsms.New(...)

client.Messages.Send(context.Background(), &httpsms.MessageSendParams{
    Content: "这是一条测试短信",
    From:    "+18005550199",
    To:      "+18005550100",
})

JavaScript/TypeScript SDK

fetch('https://your-server/v1/messages/send', {
  method: 'POST',
  headers: {
    'x-api-key': "xxx",
    'Accept': 'application/json',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    "content": "这是一条测试短信",
    "from": "+18005550199",
    "to": "+18005550100"
  })
})
.then(res => res.json())
.then(data => console.log(data));

Python direct call

import requests, json

headers = {
    'x-api-key': "xxx",
    'Accept': 'application/json',
    'Content-Type': 'application/json'
}

payload = {
    "content": "这是一条测试短信",
    "from": "+18005550199",
    "to": "+18005550100"
}

response = requests.post('https://your-server/v1/messages/send', headers=headers, data=json.dumps(payload))
print(response.json())

Security features

End‑to‑end encryption (E2EE)

AES‑256 encryption; the key is stored only on the Android device.

Even if the server is compromised, SMS content remains unreadable.

Both sending and receiving messages are transmitted encrypted.

Rate control (Back Pressure)

# Set a maximum of 3 messages per minute
# Even if you call the API 100 times at once, only 3 msgs/min are sent

Message expiry

# Set message TTL to 5 minutes
# If the phone does not receive the push within 5 minutes, the message expires and you are notified

Typical use cases

2FA codes for personal apps or internal systems.

Operations alerts: immediate SMS when servers crash or CPU spikes.

Automated testing: receive and verify SMS verification codes during development.

IoT device notifications: enable devices without direct network access to report status via a phone.

Comparison with other solutions

Cost : HTTPSMS – free/self‑hosted; Twilio – per‑message charge; Cloud SMS – per‑message charge; Self‑built GSM modem – hardware cost.

End‑to‑end encryption : HTTPSMS – AES‑256 ✅; Twilio – ❌; Cloud SMS – ❌; GSM modem – local ✅.

Self‑hosting : HTTPSMS – fully supported ✅; Twilio – ❌; Cloud SMS – ❌; GSM modem – ✅.

Webhook support : HTTPSMS, Twilio, Cloud SMS – ✅; GSM modem – ❌.

Rate control : HTTPSMS, Twilio, Cloud SMS – ✅; GSM modem – ❌.

Message expiry : HTTPSMS – ✅; Twilio – ⚠️; Cloud SMS – ❌; GSM modem – ❌.

Open‑source license : HTTPSMS – AGPL‑3.0 ✅; others – ❌.

References

Documentation: https://docs.httpsms.com

GitHub repository: https://github.com/NdoleStudio/httpsms