Skip to content

Integration - API 📱

The SMSGate provides a robust API that allows you to send SMS messages programmatically from your own applications or services. This enables seamless integration with your existing infrastructure.

API Specification 📄

You can find the OpenAPI specification for our API at the following link: OpenAPI Specification. This specification includes detailed information about the available endpoints, request/response structure, and more.

End-to-End Encryption

The device listing (GET /3rdparty/v1/devices) includes publicKey (base64 X.509 SPKI DER of the RSA-2048 public key) and keyVersion (device-sourced rotation version) for devices with E2E encryption enabled. Send deviceId to target a specific device and encrypt messages for it. See the encryption guide for the wire format, key rotation, and migration details. The API server is the trusted distributor of device keys: on first use, verify the device key fingerprint out of band and pin it (see Trust model and key verification).

Local vs Cloud API Access

While both API endpoints use the same authentication method and request format, there are critical differences in accessibility:

  • Local Server API: Only accessible within your local network (same Wi-Fi/Ethernet)
  • Cloud API: Accessible from anywhere on the internet

External services like Google Apps Script, AWS Lambda, or other cloud functions cannot directly access Local Server API endpoints due to network constraints.

Authentication 🔒

The SMSGate API supports two authentication methods:

  1. Basic Authentication (Legacy): Simple username/password authentication for backward compatibility
  2. JWT Bearer Tokens (Recommended): Modern, secure authentication with fine-grained access control

Recommendation

For new integrations, we strongly recommend using JWT authentication as it provides better security, scalability, and fine-grained access control through scopes. See Authentication Guide for detailed information.

Authentication Comparison

Feature JWT Authentication Basic Authentication
Security High (token-based with expiration) Medium (credentials sent with each request)
Access Control Fine-grained (scopes) Coarse-grained (all or nothing)
Token Management Built-in (revocation, TTL) None
Recommended For All new integrations Legacy systems only

See Also 🔗