Until now, you wrote texts on your computer in the dashboard, in a browser tab. The desktop app does the same job as a real app: it stays in the tray, it can start with your computer, and it tells you when a text arrives.

What the desktop app does

• Your conversations, by number. With search, unread markers and each text’s status: sent, delivered or failed.
• Writing through your own phone. You type on your computer, and your phone sends the text from your number, so people see a number they know and can reply. One text goes to one number.
• Notifications. With sync on in the phone app, every text your phone receives shows up as a notification, with its text or just “New text”.
• The tray. Close the window and SMSTunnel keeps running, so new texts still show up. It can start with your computer.
• All your phones. See which ones are connected and choose which one sends. On a dual-SIM phone, a reply goes out from the SIM that received the text.
• Updates. It updates itself, and installs only updates signed by SMSTunnel.
• Light or dark, English or Romanian, like your computer.

How to start

1. Install the SMSTunnel app on your Android phone from Google Play and sign in with your SMSTunnel account. Keep the phone online, with the app running: the phone is what sends your texts.
2. Download the desktop app for Windows (10 or 11, 64-bit) or Linux (AppImage, .deb or .rpm), and install it.
3. Open it and sign in with the same SMSTunnel account. Your phone shows up by itself.
4. To see the texts your phone receives, turn on Settings › Received texts › Sync received texts in the phone app.

If you sign in with Google or Facebook, first set a password in the dashboard, under Account › Security, then sign in on your computer with your email.

On Windows, the simplest way is the Microsoft Store: it installs SMSTunnel without any warning and keeps it up to date. With the installer from the download page instead, the first time you open it Windows may say “Windows protected your PC”: that installer isn’t signed with a code-signing certificate yet. Click More info, then Run anyway. The download page has the details, and the checksums to check your download.

Your texts and your privacy

This is how texts travel today, in the desktop app as in the dashboard:

• Texts you write go through your SMSTunnel account to your phone, which sends them.
• Texts your phone receives reach your computer only while sync is on in the phone app. Only texts that arrive after you turn it on are synced, and your existing inbox is never read.
• In your account, your texts are stored in readable form, so the dashboard and the desktop app can show them. They aren’t end-to-end encrypted.
• One exception: the lock next to the text box, “Encrypt for my phone”, encrypts a text on your computer so that only your phone can read it. smstunnel.io still sees the number and the time.
• On your computer, the app keeps no texts. Your sign-in stays in your system’s credential store (Windows Credential Manager, or your Linux keyring), your password is never stored, and the app has no ads, analytics or tracking.

Coming: end-to-end private texts

We’re building end-to-end private texts for the desktop app, on every plan. Your messages will be readable only on your phone and on your computers: smstunnel.io will keep only encrypted copies it can’t read. We’ll write about it here when it’s ready.

The encryption is about SMSTunnel’s part of the journey. Before a text reaches your phone, and after your phone sends one, it travels over the mobile network like any other SMS.

Texts your own software sends already have their own option: end-to-end encryption, on every plan, where your software encrypts each text for your phone and SMSTunnel can’t read it. See end-to-end encrypted SMS.

The dashboard, and when to use which

The dashboard works in any browser and needs nothing installed, on a Mac too, until the macOS version comes. The desktop app adds notifications, the tray and starting with your computer. Both show the same account and the same texts, so use whichever is at hand.

Common questions

Is the desktop app free?

Yes, on Windows and on Linux. Your SMSTunnel plan sets how many texts you can send each day, and your mobile operator charges each text like any SMS from your phone.

Which systems does it run on?

Windows 10 and 11 (64-bit), from the Microsoft Store or with the installer from the download page, and 64-bit Linux: an AppImage, a .deb for Ubuntu, Debian and Mint, and an .rpm for Fedora and openSUSE. A macOS version comes later.

Can SMSTunnel read the texts I receive?

Synced texts are stored in your account in readable form, so the dashboard and the app can show them; they aren’t end-to-end encrypted yet. Our staff don’t look at your messages, except when that’s needed to answer a support request you send us or to investigate abuse. End-to-end private texts for the desktop app, which smstunnel.io won’t be able to read, are coming, on every plan.

Do I still need my phone?

Yes. The desktop app reads and sends texts through your own phone, and every text goes out from your own number. The phone must be online with the SMSTunnel app running; if it’s offline, a text waits and goes out when the phone is back, for up to 3 days.

Picture an invoicing app used by a few hundred small companies. When one of them issues an invoice, its customer gets a text: “Acme Dental: invoice no. 2087 has been issued. Total: $240.” With SMSTunnel’s Enterprise plan, that text goes out from Acme Dental’s own Android phone, from Acme Dental’s own number. The customer knows who wrote, and a reply or a call back reaches Acme Dental, not you.

This guide walks through the whole flow: your app links each client’s own phone with a QR code, gets that client’s key back on its own, and hands their texts to their phone. You’ll see the code with the Node.js SDK, what your dashboard shows, a real deployment, and an honest comparison with the usual workarounds.

Why each client’s own number matters

• People know the number. A text from the business they deal with every day reads as a message from that business, because it is one.
• Replies reach the right people. When a customer answers, the reply lands on your client’s phone. You don’t end up running a support inbox for your clients’ customers.
• Each client uses their own SIM and plan. SMSTunnel charges no per-message fees, so the texts a client’s phone sends go on that client’s mobile plan, at their carrier’s rates.
• No numbers to rent or register. Your clients already have a phone and a number. Your app only needs to link them.

How the Enterprise flow works

The flow has five steps, and only one of them involves your client:

1. You create an Enterprise app in your SMSTunnel dashboard and get its key. That key carries the enterprise:saas permission, which links clients; other keys get a 403.
2. Your backend starts linking a client with activateEnterpriseClient(): the client’s name, your own id for them (externalId) and a callback URL. SMSTunnel makes the client’s account (or reuses it) and returns a QR code and the client’s own API key.
3. Your client scans the QR code. They install the SMSTunnel app from Google Play on their own Android phone, open Connections, tap Link with QR code and scan the code your app shows them.
4. SMSTunnel calls your callback URL with a pairing_completed event, the token from the QR code and the client’s key.
5. Your app sends that client’s texts with their key. Each text goes to their phone, which sends it from their number. getEnterpriseClient(externalId) tells you at any time whether the phone is linked and online.

Your client never copies an API key and never opens SMSTunnel’s dashboard: they install the app and scan one code.

Step by step with the Node.js SDK

The Enterprise calls are in the official SDK, @narcisbodea/smstunnel-sdk, both as a standalone Node.js client and as a NestJS module.

npm install @narcisbodea/smstunnel-sdk

1. Create the Enterprise app

On the Enterprise plan your dashboard has a Company section. Under Company → Apps, choose Add an app: one app for each product of yours that serves clients. Copy its key and keep it in an environment variable on your server, never in code that runs in a browser or a mobile app.

2. Start linking a client

When a client turns on texting in your app, your backend asks SMSTunnel for their QR code:

import { SmsTunnelNodeClient } from '@narcisbodea/smstunnel-sdk/node';

// The key of your Enterprise app (Company → Apps).
const company = new SmsTunnelNodeClient({ apiKey: process.env.SMSTUNNEL_ENTERPRISE_API_KEY! });

const activation = await company.activateEnterpriseClient({
  clientName: 'Acme Dental',                                  // shown in the app and in your dashboard
  externalId: 'tenant-42',                                    // your own id for this client
  callbackUrl: 'https://invoices.example.com/smstunnel/callback',
});

// Keep these with the client's record in your own database:
const clientKey = activation.apiKey.key;      // works for sending once their phone has linked
const pairingToken = activation.pairingToken; // the token the callback will carry
const qrData = activation.activation.qrData;  // show this as a QR code

The client’s key is a secret like any other API key: store it on your server only.

3. Show the QR code

Render qrData with any QR code library, on the page where your client turns on texting. They scan it with the SMSTunnel app, and the app shows the client name you sent, so they can see what they are linking.

4. Handle the callback

When the phone links, SMSTunnel posts pairing_completed to your callbackUrl, which must be an https address on a public host. Accept it only when its token is one you got from step 2:

app.post('/smstunnel/callback', express.json(), async (req, res) => {
  const { event, token, apiKey } = req.body;
  const tenant = await db.tenants.findOne({ smstunnelPairingToken: token }); // your own database
  if (event !== 'pairing_completed' || !tenant) return res.sendStatus(404);

  await db.tenants.update(tenant.id, { smstunnelKey: apiKey, smsReady: true });
  res.sendStatus(200);
});

5. Send texts from the client’s phone

Each client’s texts go through a client object made with that client’s key. One text goes to one number:

import { SmsTunnelNodeClient, SmsTunnelApiError } from '@narcisbodea/smstunnel-sdk/node';

async function textInvoiceIssued(tenant, invoice) {
  const sms = new SmsTunnelNodeClient({ apiKey: tenant.smstunnelKey });
  try {
    await sms.sendSms(
      invoice.customerPhone, // international format, like +14155550123
      `${tenant.name}: invoice no. ${invoice.number} has been issued. Total: ${invoice.total}.`,
    );
  } catch (error) {
    if (error instanceof SmsTunnelApiError) console.error(error.status, error.message);
    else throw error;
  }
}

6. Check whether a client’s phone is linked and online

const { activation } = await company.getEnterpriseClient('tenant-42');
// activation?.status: 'pending' | 'connected' | 'expired' | 'cancelled'
// activation?.isOnline: whether their phone is online right now

Show that status next to the client in your own app, so they know whether texting works before they rely on it.

With NestJS

If your backend is NestJS, the SDK’s module has an Enterprise mode: pass your Enterprise key and the current organization’s id, and SmsTunnelService does the linking and the sending for that organization.

SmsTunnelModule.forRootAsync({
  useFactory: (settingsModel, tenantService) => ({
    storage: new MongoSmsTunnelStorage(settingsModel),
    callbackBaseUrl: process.env.CALLBACK_URL,
    displayName: 'My App',
    enterpriseApiKey: process.env.SMSTUNNEL_ENTERPRISE_API_KEY,
    externalId: tenantService.getCurrentTenantId(),
  }),
  inject: [getModelToken('Settings'), TenantService],
})

await smsTunnelService.getEnterpriseClientStatus() then tells you whether that organization’s phone has linked and is online. The other storage adapters (Prisma, a JSON file) are in the SDK’s README.

What your dashboard shows

The Company section has five tabs: Overview, Clients, Phones, Apps and Invitations. Clients and phones are many-to-many: a client can link more than one phone, and one phone can serve several clients. That is how a client without a phone of their own can still send: under Phones you can share one of your own phones with your clients. Each client and each phone has its own page, with the texts it sent over the last 30 days and the texts still waiting for a phone.

You don’t need code for every client either. Under Invitations you create a QR code for a client, send it to them or show it, and they scan it in the SMSTunnel app to join your company. An app with its own key is only needed when your software links clients by itself.

A real deployment: one office in every county

One of the apps built on this flow serves a public education network with an office in each county. The app keeps a single Enterprise key in its settings. Each county office is a client with its own externalId; someone at the office scans the QR code once with the office’s phone, and from then on the app sends that office’s texts from that office’s own number. People get texts from the local office they deal with, and when they call back, they reach that office.

Things to know before you build

• One recipient per text. Each call sends one text, up to 1600 characters, to one number. For several people, make one call per person.
• Pace your sending. The API accepts 30 send requests a minute per API key on each send endpoint (all the keys of one account together get three times that), so if your server sends for many clients at once, queue the texts and retry after a 429 when the Retry-After time has passed.
• Phones go offline. If a client’s phone is off, their texts wait and go out when it is back, for up to 3 days; after that they are marked failed.
• Linking again is safe. Calling activateEnterpriseClient() again for the same externalId replaces the earlier activation and its key, while a phone that already linked stays linked. Two overlapping calls for one client can get a 409 with code: 'CONCURRENT_ACTIVATION' or 'ALREADY_CONNECTED'.
• With the NestJS module, a new QR code starts a new link. Since SDK 2.2.0, createPairingToken() clears the organization’s stored key until its phone scans the new code, so its texts stop in between. Offer a QR code only while no phone is linked (getEnterpriseClientStatus() tells you).
• Your clients stay in charge of their phones. A phone’s owner can unlink it in the app or in the dashboard.
• Privacy, if you need it. Your app can encrypt each text end to end for the phone that sends it, and the Enterprise plan includes Maximum privacy, where the number is sealed too.

How this compares to other ways of doing it

Other tools that send texts from an Android phone, such as httpSMS and textbee, are built around one account and its own phones. From our comparison pages, checked in November 2026:

• httpSMS: phone keys put several phones in one account, and each key is made by hand in its dashboard. See SMSTunnel vs httpSMS.
• textbee: phones belong to one account, 1, 5 or 15 depending on the plan, with no accounts for your clients. See SMSTunnel vs textbee.

With either, the usual workaround for a multi-tenant app is to ask each client to open their own account, link their phone there, create an API key and paste it into your app. It works, but every client has to understand API keys, your support team has to explain them, and you never see your clients’ phones in one place.

SMS API providers such as Twilio solve a different problem: they send from numbers you rent from them. That suits high volumes and many countries, but the texts don’t come from your clients’ own numbers.

What it costs

The Enterprise plan is $99 a month, or $990 a year, before tax. It has no daily cap (texts are rate-limited to protect the SIMs), sign-in codes with no daily cap, separate API keys for each of your apps, Maximum privacy and dedicated support. SMSTunnel adds no per-message fees: each text uses the mobile plan of the phone that sends it. The pricing page has every plan, and this comparison of costs explains what an own SIM costs next to an SMS API.

Want to try the phone side first? Any plan, including Free, lets you link your own phone and send from your own software. When you are ready to link your clients’ phones, the Enterprise plan adds the Company section and the calls above, and if you’d like help connecting your own systems, write to us.

It’s optional, and it’s included on every plan, even Free. This article explains how it works, which integrations support it, how to turn it on, and, just as important, what it does not cover. Encryption you can’t describe exactly is worth little, so the limits come first-class here, not in a footnote.

How it works

There are three steps, and only the first and the last can read the text:

1. Your software encrypts. It locks the text with your phone’s public key, on your own server, before anything leaves it. Each phone has its own RSA-2048 key pair; the private key never leaves the phone, and SMSTunnel stores only the public key.
2. SMSTunnel carries. Our servers pass the locked text on, and erase it once it’s sent. We can’t read the message.
3. Your phone sends. Only your phone holds the private key. It unlocks the text and sends it as a regular SMS from your number.

What SMSTunnel still sees with encryption on: your account, your phone and the time of each text, plus the number the text goes to, unless you use Maximum privacy (below).

What is encrypted, and what isn’t

All traffic to and from SMSTunnel uses encrypted connections (TLS 1.2 or higher), whether or not a text is end-to-end encrypted. The table is about who can read the words once they arrive.

On received texts: end-to-end encryption for them, readable only on your phone and in a desktop app that’s coming, is being built.

Turn it on in WordPress

The SMSTunnel plugin for WordPress encrypts its texts for your phone before they leave WordPress. It needs your phone’s public key once, which it gets with a QR code:

1. In WordPress, go to SMSTunnel → Encryption Settings.
2. Start the encryption pairing to show a QR code.
3. Scan the QR code with the SMSTunnel app on your phone.
4. Done: texts from your site are now end-to-end encrypted.

During the pairing the phone shares only its public key. Its private key never leaves the phone, so SMSTunnel stores only encrypted text that it cannot read. Keep in mind the one exception from the table: the plugin’s sign-in codes for WordPress logins are not encrypted.

Encrypt from your own code

With the Node.js SDK

The official SDK does the whole job in one call: it fetches your phone’s public key, encrypts the number and the words, and sends the result.

import { SmsTunnelNodeClient } from '@narcisbodea/smstunnel-sdk/node';

const client = new SmsTunnelNodeClient({ apiKey: process.env.SMSTUNNEL_API_KEY! });

// Encrypts { to, message } with the phone's public key, then sends it.
await client.encryptAndSendSms('+14155550123', 'Your order has shipped.', 'device-id');

The device-id is the phone that will send the text: client.getDevices() lists your phones with their ids. In the SDK’s NestJS module, smsTunnelService.encryptAndSendSms(to, message) exchanges keys with the phone the first time and encrypts from then on.

Encryption has to run on your server. Browsers can’t do it with the SDK, and your API key must never reach a browser anyway.

With the REST API, in any language

Without the SDK, the steps are the same:

1. Get the phone’s public key with GET /api/v1/devices/{deviceId}/public-key.
2. Encrypt the JSON {"to": "+14155550123", "message": "…"} with it, on your server.
3. Send the result to POST /api/v1/sms/send as encryptedPayload (base64), with "encrypted": true, the deviceId and, as well, to, so your Messages page can show the number.

{
  "to": "+14155550123",
  "deviceId": "671fe0d9c3b2a1f0e9d8c7b6",
  "encrypted": true,
  "encryptedPayload": "BASE64_OF_THE_ENCRYPTED_JSON"
}

You don’t have to work out the encryption format yourself: when you add an app in your dashboard and choose to encrypt end to end, it gives you ready code for PHP, Node.js, Python and C#. The API reference has the details.

One practical difference: an encrypted text counts toward your plan’s daily limit and is refused past it, because it can’t carry the short “free by smstunnel.io” line that the Free plan adds to the extra texts of the day.

Notice when the phone’s key changes

If the SMSTunnel app is reinstalled, the phone makes a new key pair. GET /api/v1/devices/{deviceId}/e2e-status returns whether encryption is on, whether a public key is stored, its fingerprint (the first 16 hex characters of a SHA-256 hash) and when it was created. Store the fingerprint after the first pairing and compare it before you send:

const result = await client.verifyDeviceKey('device-id', storedFingerprint);
if (result.needsRePairing) {
  // The app was reinstalled and the key changed: pair again before sending.
}

Maximum privacy: hide the number too

End-to-end encryption hides the words. On the Professional and Enterprise plans, Maximum privacy hides the number as well, so we can’t see who a text is for.

It works with a private certificate that you make, protected by a password only you know. You put the certificate in your software and on your phone, the key never passes through our servers, and from then on your phone refuses any text that isn’t sealed with it, including texts written in the dashboard.

1. Make the certificate

In your dashboard: Apps → Add an app → Encrypt end to end → Maximum privacy, which also gives you ready code for PHP, Node.js, Python and C#. Or make it on your own computer, where nothing leaves the machine:

npx -p @narcisbodea/smstunnel-sdk smstunnel-make-certificate

It asks for a password of at least 12 characters and saves smstunnel-certificate.json.

2. Put it on your phone

In the SMSTunnel app (version 1.0.9 or newer), open Settings → Private certificate and paste the contents of the file. If you’d rather scan a QR code, the dashboard shows one under Apps → Maximum privacy → “I already have one”.

3. Send sealed texts

import { readFileSync } from 'node:fs';
import { SmsTunnelNodeClient, openCertificate } from '@narcisbodea/smstunnel-sdk/node';

const client = new SmsTunnelNodeClient({ apiKey: process.env.SMSTUNNEL_API_KEY! });
const certificate = openCertificate(
  readFileSync('smstunnel-certificate.json', 'utf8'),
  process.env.SMSTUNNEL_CERT_PASSWORD,
);

await client.sendSealedSms('+14155550123', 'Your order has shipped.', 'device-id', certificate);

Over the REST API, a sealed text is sent as encryptedPayload with "encrypted": true and the deviceId, and without to.

What to know before you switch it on:

• We still see your account, your phone and the time of each text.
• If you sync received texts to your account, a reply shows the number it came from.
• Your software needs the certificate and its password to send. Keep the password out of your code, for example in an environment variable.
• We can’t recover a lost certificate or password. If you lose either, make a new certificate and put it on your phone and in your software again.
• On the other plans, a text without to, or one sealed with a certificate, is refused with status 403.

How this compares

Among the tools that send texts from your own Android phone, httpSMS also offers optional end-to-end encryption: you set one key in its app and use the same key in your code, for sent and received texts. For textbee, we found no end-to-end encryption in its documentation, which says its API traffic uses HTTPS and that it stores your messages on its servers. SMSTunnel uses a key pair per phone, so the key that unlocks your texts never leaves the phone, and adds Maximum privacy for the number on Professional and Enterprise.

Common questions

Can SMSTunnel read my encrypted texts?

No. We only ever have the phone’s public key, which can lock a text but not unlock it, and we erase the locked text once it’s sent.

Is the SMS encrypted on its way to the person I text?

No. End-to-end here means from your software to your phone. Once your phone sends the text, it is a regular SMS on the mobile network.

Does encryption cost extra?

No. It’s on every plan, including Free. Maximum privacy comes with Professional ($39 a month) and Enterprise ($99 a month); see the pricing page.

Can apps with many clients use it?

Yes. On Enterprise, each client links their own phone, and your app can encrypt each text for the phone that will send it.

This guide puts numbers on both. The providers’ prices below are the US list prices our comparison pages recorded in November 2026. They differ by country and change over time, so check each provider’s own pricing for the countries you text. SMSTunnel’s plans are the ones on the pricing page.

One caution before the numbers: the two models don’t do the same job. An SMS API delivers every text over the carrier networks itself, and its price per text pays for that. With SMSTunnel, your phone does the delivery, so each text is paid for by your mobile plan, not by SMSTunnel. The right choice depends on what you send, how much, and to whom.

What an SMS API charges for

A provider’s bill has several lines. These are the US prices from our comparison pages:

On top of that:

• Carrier fees. US carriers add their own fee for each text sent, which the provider passes on: for example $0.0035 (AT&T), $0.0045 (T-Mobile) or $0.005 (Verizon). Some carriers charge for received texts too.
• Registration. To text US customers as a business from a local number, you register your brand and each use case for A2P 10DLC. At Twilio that’s a one-time brand fee of $4.50 (or $46 for a standard brand), $15 to review each use case, and $1.50 to $10 a month for each one. Vonage and Plivo charge similar fees, and Vonage adds $41.50 for the vetting most use cases need.
• Failed texts. Twilio charges $0.001 for each text that ends up failed.
• Replies. Every reply your customers send is a received text, and it’s billed like one.

Long texts and special characters

Providers bill per segment, and a segment holds up to 160 characters. A longer text goes out as several segments joined together, and each one counts. Characters outside the basic GSM alphabet, such as accented letters like ă or ș and most emoji, usually cut a segment to 70 characters, so the same message can cost two or three times as much. Your mobile plan usually counts the parts of a long text the same way, so short texts pay off with either model.

What you pay when your own phone sends

SMSTunnel charges a flat price, monthly or yearly, with nothing per text, nothing per number and no registration:

Paying yearly costs ten months: $90, $190, $390 or $990 a year. Prices are in US dollars, before tax; where tax applies, it’s added at checkout and shown on your invoice. Plans are month to month or yearly, with no contract. Only the texts you send count toward a plan: the texts your phone receives don’t.

Then there’s your mobile plan. The texts leave from your SIM, so your carrier’s normal SMS charges or allowance apply, including for texts to other countries. Many plans include unlimited texts, but a personal plan may not allow business use: check your plan before your shop starts texting customers from it.

Two worked examples

The examples below use US prices and single-segment texts. Your own numbers will differ, but the shape of the bill won’t.

A shop sending 1,000 order texts a month

With Twilio:

• 1,000 texts × $0.0083 = $8.30
• carrier fees: about $3.50 to $5.00, depending on your customers’ carriers
• a local number: $1.15
• 10DLC: $1.50 to $10 a month for the use case, after $19.50 to $61 once

That’s roughly $14.45 to $24.45 a month, before any replies.

With SMSTunnel, 1,000 texts a month is about 33 a day, more than the Free plan’s 25 as written, so you’d pick Starter: $9 a month, or $90 a year, plus your mobile plan. The WooCommerce guide shows the setup for an online shop.

A business sending 10,000 texts a month

With Twilio, the texts alone come to $83, carrier fees add about $35 to $50, and the number and the registration add a few dollars more: roughly $120 to $145 a month.

With SMSTunnel, 10,000 texts a month is about 330 a day, past Starter’s 300, so Standard at $19 a month fits, plus your mobile plan. At this volume, check that your plan allows that many texts, and remember that one phone sends at its own pace (more on that below).

Sign-in codes

Twilio Verify sends codes and checks them for you: $0.05 per successful verification plus $0.0083 per text in the US. Vonage Verify charges $0.06084 per successful verification plus messaging rates, and Plivo Verify charges no verification fee, only the text. With SMSTunnel, your software makes the code and checks it, and SMSTunnel sends the text, with a separate allowance: 50 codes a day on Free and no daily cap on paid plans. The sign-in codes guide covers Supabase, Auth0, Clerk and Better Auth.

Other tools that send from your own phone

SMSTunnel isn’t the only way to send from an Android phone. textbee has a free plan with 50 texts a day (300 a month) on one phone, where received texts count too, then Pro at $14.99 and Scale at $29.99 a month. httpSMS has 200 free texts a month, sent and received together, and paid plans from $10 to $350 a month. Like SMSTunnel, neither charges per text: your carrier’s charges apply. Both are open source and can run on your own server, and both install from an APK rather than from Google Play.

When an SMS API is worth the price

Our comparison pages are frank about this. Choose an SMS API provider when:

• you send high volumes: registered 10DLC numbers and short codes send many texts a second, while SMSTunnel sends what one phone can;
• you need a short code, a toll-free number or a sender name instead of a phone number;
• you text US customers as a business from a local number, where A2P 10DLC registration is the route US carriers set;
• delivery mustn’t depend on a phone being on and online;
• you need numbers in many countries without a SIM in each;
• you want MMS, WhatsApp or RCS from the same API, or a service that checks sign-in codes for you;
• you have no Android phone to keep on and online.

You can also use both: everyday texts from your own number, and a provider for the rest.

The limits of one phone

A flat plan doesn’t turn a phone into a carrier. Keep these limits in mind:

• Pace. The API takes 30 send requests a minute on each send endpoint.
• Daily caps. Free, Starter and Standard have daily caps. Professional and Enterprise don’t, but they’re rate-limited to protect your SIM.
• One recipient per text. Each person gets their own text.
• A phone that’s on. If your phone is offline, the text waits and goes out when it’s back, for up to 3 days; after that, it’s marked failed.
• Status. You get pending, sent or failed, as your phone reports it.

If your app sends for many clients, each from their own phone and number, that’s the Enterprise plan: see one app, each client’s own number.

Common questions

Does SMSTunnel charge per message?

No. The plans are flat, and your texts go out from your own SIM, so your carrier’s normal SMS rates or allowance apply.

Is the Free plan enough to start?

For testing and small volumes, yes, and it needs no credit card: 25 texts a day and 500 a month as you wrote them, plus 50 sign-in codes a day. Texts your own software sends beyond that, up to 25 more a day, end with a short “free by smstunnel.io” line. Paid plans add nothing to your texts.

Can I keep my SMS API provider?

Yes. Texts sent through SMSTunnel come from the SIM in your phone, and your provider’s numbers keep working. You can send everyday texts from your own number and keep the provider for high volumes, short codes or other countries.

A short text is often the fastest way to tell customers that their order went through, that it has shipped, or that something needs their attention. The usual way to send them is an SMS API provider such as Twilio: you rent a number from the provider and pay for every text, and texting US customers from a local number also means registering it first (A2P 10DLC).

For many small shops there is a simpler route. Your WooCommerce store hands each order text to your SMSTunnel account, and the SMSTunnel app on your own Android phone sends it from your own number, on your own SIM and mobile plan. Customers see a number they can recognize and reply to, and SMSTunnel charges no per-message fees.

This guide sets it up from scratch with two free plugins from WordPress.org: the SMSTunnel core plugin, which links your site to your phone, and SMSTunnel for WooCommerce, which adds the order texts.

How it works

1. Something happens in your shop: a customer places an order, or you move an order to Completed.
2. SMSTunnel for WooCommerce writes the text from your template and hands it to your SMSTunnel account.
3. The SMSTunnel app on your phone sends it as a normal SMS from your number.

Each text goes to one number: the billing phone of that order. If your phone is offline for a while, the texts wait in your account and go out when it is back online, for up to 3 days.

What you need

• WordPress 5.0 or newer, PHP 7.4 or newer and WooCommerce 5.0 or newer
• An Android phone (Android 7.0 or newer) with a SIM card, which stays on and online
• The SMSTunnel app from Google Play, signed in to your SMSTunnel account (the Free plan needs no credit card)
• The SMSTunnel core plugin and SMSTunnel for WooCommerce, both free on WordPress.org

Step 1: Link your site to your phone

Install the core plugin first. In your WordPress admin, go to Plugins → Add New, search for SMSTunnel, click Install Now and then Activate.

Then open SMSTunnel → Quick Setup. In the SMSTunnel app on your phone, open Connections → Link with QR code, scan the code and approve the connection on the phone. You can remove that connection in the app (Connections) at any time.

If you prefer a key, go to SMSTunnel → Settings and use Connect with API Key, with a key you create in your dashboard under Apps → Add an app.

Step 2: Install SMSTunnel for WooCommerce

Go to Plugins → Add New again, search for SMSTunnel for WooCommerce, click Install Now and Activate. Its settings live in WooCommerce → Settings → SMS.

The add-on works with WooCommerce’s High-Performance Order Storage (HPOS), and with both the Checkout block and the classic checkout.

Step 3: Choose which order statuses send a text

The SMS tab has a switch for each text to the customer:

• New Order (Pending): the order still waits for payment, for example while the customer pays on another site
• Order Processing, Order Completed, Order On Hold, Order Cancelled and Order Refunded: sent each time an order moves to that status
• Shipment Tracking: a text with the tracking number (more on that below)

New Order (Pending), Order Processing and Order Completed are on by default, and the add-on follows the tab from the start, even before you save it once. So check the tab right after you activate the plugin.

A customer who places an order gets one text at checkout, not two. If the order still waits for payment, it is the New Order (Pending) text. Otherwise it is the text for the status the order has at that moment, such as Order Processing for cash on delivery.

This screenshot comes from an earlier version, which still had a WooCommerce 2FA checkbox at the top. That checkbox did nothing and was removed in version 1.0.5: sign-in codes for the My Account login come from the core plugin (see the questions below).

Step 4: Write your messages

Each text has its own template under SMS Message Templates, with these placeholders:

The default New Order Message reads: “Hi {customer_first_name}, thank you for your order #{order_id} ({order_total}) at {site_name}. We’ll process it soon!” The default Completed Message: “Your order #{order_id} has been completed. Thank you for shopping at {site_name}!”

Keep them short and useful, and in your customers’ language. A text that says what happened and what comes next works better than a long one.

Texts to you: new orders and low stock

The same tab has notifications for the shop itself. Put your own number in Admin Phone Number (one number, with + and the country code), then turn on:

• Notify Admin on New Order: a text to you once for every order placed at checkout, even when the customer’s text is off or the customer gave no phone number
• Low Stock Alert: a text when a product runs low or out of stock

Tracking numbers

The Shipment Tracking text goes out when you add a tracking number with the free Advanced Shipment Tracking plugin, once per tracking number. Other tracking plugins don’t tell other plugins when they add a number, so they aren’t supported directly.

Developers can send the tracking text from their own code by firing the action the add-on listens to:

do_action( 'woocommerce_shipment_tracking_number_added', $order_id, $tracking_number, $tracking_provider );

Ask for numbers in international format

Customer texts go to the order’s billing phone, exactly as the customer typed it. The add-on doesn’t check or complete the number, and a number without + and the country code can reach the wrong country. Orders without a phone number get no text.

So say it clearly at checkout, in the field’s label or a short note: the number should start with + and the country code, like +44 7700 900123.

On the order page, a Send SMS box sends a one-off text to the customer, and every text sent on a status change is recorded in the order notes.

How many texts will your shop send?

Count about two or three texts per order (one at checkout, one when it’s completed, maybe one with the tracking number), plus one to you if you turned on the new order alert.

• Free: 25 texts a day and 500 a month, sent exactly as you wrote them. Your site can send up to 25 more a day, each ending with a short “free by smstunnel.io” line.
• Starter, $9 a month: 300 texts a day and 5,000 a month.
• Standard, $19 a month: 2,000 texts a day and 30,000 a month.

A shop with a few orders a day can stay on Free. One with ten orders a day and three texts per order sends about 30 texts a day, which fits Starter. Prices are before tax, and yearly plans cost ten months. The texts themselves go out over your own mobile plan, so your carrier’s SMS rates or allowance apply. Check that your plan allows this kind of use, and see the pricing page or our cost comparison of your own SIM and an SMS API.

When Twilio is still the better fit

Your own phone works well for the texts a phone sends comfortably: order updates, reminders and sign-in codes. An SMS API provider fits better if you send at high volumes, need short codes or a sender name instead of a number, need registered US 10DLC numbers, or text customers in many countries.

When we compared them in November 2026, Twilio’s US pricing listed $0.0083 per text segment plus carrier fees, and $1.15 a month for a local number, plus the registration fees for US local numbers. The full side-by-side is on SMSTunnel vs Twilio, and nothing stops you from using both.

Common questions

Can customers reply?

Yes. The texts come from your own number, so replies reach your phone like any other text. If you turn on syncing of received texts in the app, you can also read and answer them on your computer.

Can I add SMS sign-in codes to the My Account login?

Yes, with the core plugin: turn on WordPress Login 2FA in SMSTunnel → Settings, and it covers the WooCommerce My Account login too. Our guide to SMS sign-in codes without Twilio covers it, with other platforms.

Does it work with subscription plugins?

The status texts follow any WooCommerce order status change, including the ones that subscription plugins make.

Can the order texts be encrypted?

Yes, optionally. Turn on end-to-end encryption in the core plugin’s settings, and your site encrypts each text for your phone before it leaves WordPress, so SMSTunnel can’t read the words. An encrypted text counts toward your daily allowance and is refused past it, because it can’t carry the free line. See end-to-end encrypted SMS for what is and isn’t encrypted.

Phone sign-in codes are usually the first reason a project opens an account with an SMS API. You rent a number, register it where your country requires it, and pay for every text and every verification. For a product whose users mostly live in one country, there is a simpler route: send the codes from an Android phone you already have, on the plan you already pay for.

That is what SMSTunnel does. Your auth platform keeps creating and checking the codes exactly as it does today. A small package, @narcisbodea/smstunnel-otp, hands each code to your SMSTunnel account, and the SMSTunnel app on your phone sends it from its own SIM. People get their code from a number they know, and they can reply to it.

This guide covers the four platforms the package plugs into with a few lines of code (Supabase Auth, Auth0, Clerk and Better Auth), Ory, which needs no code at all, WordPress logins, and the limits you should know before you switch.

How it works

1. A user asks for a code: they sign in with their phone number, add one, or confirm a second factor.
2. Your auth platform creates the code and calls your hook, Action, webhook or function, the place where it would normally call its SMS provider.
3. The package sends the text to SMSTunnel’s code endpoint, POST /api/v1/sms/send-2fa, with your API key.
4. Your SMSTunnel account hands the text to your phone, and the phone sends it from your own number.
5. The user types the code, and your auth platform checks it, as before.

SMSTunnel never checks codes. Unlike Twilio Verify, it doesn’t create or verify them: your platform does that, and SMSTunnel only delivers the text. Codes also have their own daily allowance, separate from your other texts, so a busy sign-in morning doesn’t eat into your order updates or reminders.

The package has no runtime dependencies (it uses Fetch and WebCrypto only), so it runs in Node 18+, Deno (Supabase Edge Functions), Bun, Cloudflare Workers and Auth0 Actions.

Before you start

1. Install the SMSTunnel app from Google Play on your Android phone and sign in. Sign in to your dashboard with the same account: the phone appears under Phones.
2. In the dashboard, open Apps → Add an app, pick Website or web app, name it and click Create the key. Copy the key right away, because it’s shown only once. Keep it in your platform’s secrets, never in code that runs in the browser.
3. Keep your codes between 4 and 10 digits. The default 6-digit codes of all the platforms below are fine; codes with letters aren’t accepted.

Then install the package:

npm install @narcisbodea/smstunnel-otp

Supabase Auth: the Send SMS hook

Instead of its built-in SMS provider, Supabase can call an HTTPS endpoint with the user’s number and the code. The package gives you that endpoint, including the Standard Webhooks signature check. Create supabase/functions/send-sms/index.ts:

import { createSupabaseSendSmsHook } from 'npm:@narcisbodea/smstunnel-otp@^1.0.0';

Deno.serve(
  createSupabaseSendSmsHook({
    apiKey: Deno.env.get('SMSTUNNEL_API_KEY')!,
    hookSecret: Deno.env.get('SEND_SMS_HOOK_SECRETS')!, // v1,whsec_...
    template: 'Your Acme code is {code}', // optional
  }),
);

Deploy it without JWT checks, because the signature protects it:

supabase functions deploy send-sms --no-verify-jwt

In the Supabase Dashboard, open Authentication → Hooks → Add a new hook → Send SMS hook, choose HTTPS, enter https://<project-ref>.supabase.co/functions/v1/send-sms, then Generate secret and Create. Store both secrets:

supabase secrets set SMSTUNNEL_API_KEY=... SEND_SMS_HOOK_SECRETS='v1,whsec_...'

Finally, enable the provider under Authentication → Sign In / Providers → Phone. The SMS provider fields aren’t used while the hook is on. Keep phone auto-confirm off, or sign-ups never ask for a code.

The hook sends the code to the number Supabase gives it and adds the + that Supabase leaves out. If SMSTunnel is busy or out of reach, it answers 429 or 503 with retry-after, which Supabase retries within its five-second budget. The full walkthrough, with a config for local development, is on the Supabase Auth page.

Auth0: a Custom Phone Provider Action

Auth0 can hand its phone messages to an Action. The custom-phone-provider trigger is the one Auth0 recommends: a single provider for MFA, passwordless SMS and phone sign-up.

1. Open Branding → Phone Provider → Custom and pick the delivery method Text.
2. In the Action editor, add the dependency @narcisbodea/smstunnel-otp and the secret SMSTUNNEL_API_KEY, then paste:

const { createAuth0CustomPhoneProvider } = require('@narcisbodea/smstunnel-otp');

const sendWithSmsTunnel = createAuth0CustomPhoneProvider();

exports.onExecuteCustomPhoneProvider = async (event, api) => {
  await sendWithSmsTunnel(event, api);
};

3. Save, then use Send Test Message. For MFA, also turn on Use Tenant-Level Messaging Provider under Security → Multi-factor Auth → Phone Message.

Codes go out with the text Auth0 rendered, in your template and the user’s language. Notices without a code, such as a blocked account or a breached password, are sent as regular texts, or ignored if you pass { nonCodeMessages: 'skip' }. SMSTunnel sends text messages only, so a voice delivery is dropped with a clear reason. If you only need MFA, the older Send Phone Message trigger works too; both are on the Auth0 page.

Clerk: the sms.created webhook

When you turn Delivered by Clerk off for an SMS template, Clerk stops sending that text and sends you an sms.created webhook instead. In Next.js, app/api/webhooks/clerk-sms/route.ts is all it takes:

import { createClerkSmsWebhook } from '@narcisbodea/smstunnel-otp';

export const POST = createClerkSmsWebhook({
  apiKey: process.env.SMSTUNNEL_API_KEY!,
  signingSecret: process.env.CLERK_SMS_WEBHOOK_SIGNING_SECRET!, // whsec_...
});

1. In the Clerk Dashboard, open Webhooks → Add Endpoint, enter your URL, subscribe to sms.created and copy the Signing Secret.
2. Under Customization → SMS, open each template you want sent from your phone (Verification code, Reset password code…) and turn Delivered by Clerk off. The setting is per template.
3. Keep the route public in your Clerk middleware: webhooks carry no session.

The handler checks the Svix signature and sends the text Clerk rendered, making sure the code is in it. For Express and other frameworks, see the Clerk page.

Better Auth: the phoneNumber plugin

Better Auth’s phoneNumber plugin asks you how to send its codes, and smstunnelSendOTP() answers:

import { betterAuth } from 'better-auth';
import { phoneNumber } from 'better-auth/plugins';
import { smstunnelSendOTP } from '@narcisbodea/smstunnel-otp';

const apiKey = process.env.SMSTUNNEL_API_KEY!;

export const auth = betterAuth({
  plugins: [
    phoneNumber({
      sendOTP: smstunnelSendOTP({ apiKey, template: 'Your Acme code is {code}' }),
      sendPasswordResetOTP: smstunnelSendOTP({ apiKey, template: 'Your Acme password reset code is {code}' }),
    }),
  ],
});

Better Auth runs sendOTP in the background when it can, so sign-in doesn’t wait for the send. If people type local numbers, add a defaultCountryCode option, or check numbers with the plugin’s phoneNumberValidator. The other options are on the Better Auth page.

Ory, WordPress and everything else

Ory (self-hosted Kratos or Ory Network) needs no package: its courier HTTP channel calls SMSTunnel directly, with a few lines of configuration. See the Ory page.

WordPress sites get sign-in codes from the SMSTunnel plugin: SMSTunnel → Settings → Two-Factor Authentication (2FA), then WordPress Login 2FA. It also covers the WooCommerce My Account login, for the roles you choose, with codes valid for 5 minutes by default.

Any other platform can use sendCode() from the same package:

import { sendCode, SmsTunnelOtpError } from '@narcisbodea/smstunnel-otp';

await sendCode({
  apiKey: process.env.SMSTUNNEL_API_KEY!,
  to: '+14155550123',
  code: '123456',
  template: 'Your Acme code is {code}', // or message: 'full text'; the code is added if it is missing
  // deviceId, defaultCountryCode, serverUrl, timeoutMs (default 10000)
});

When something goes wrong, it throws a SmsTunnelOtpError with the HTTP status, a code such as RATE_LIMITED, and retryable: true for the errors worth retrying.

What counts as a code

The code endpoint refuses texts without a code, so your wording matters a little:

• A code is 4 to 10 digits standing on their own (482913, Code: 1234, G-123456), or two groups of 3 digits joined by a dash (123-456).
• Not a code: codes with letters, numbers of 11 digits or more, digits right after a + (a phone number), and digits joined to others by ., ,, : or /, such as prices, times and dates.
• A text can be up to 320 characters. The package refuses a longer one before calling SMSTunnel.

A text without a code is refused with a 400. Messages that aren’t codes go through the regular send endpoint.

Limits, and when an SMS API is the better fit

Sending codes from a phone is not the same as renting a pipe from a carrier, and it’s worth knowing the difference before you switch:

• One number per text. Every code goes to one person.
• 30 sends a minute. Past that, SMSTunnel answers 429 and the package marks the error as retryable.
• Your phone has to be on and online. If it’s offline, the code waits and goes out as soon as the phone is back. A code that waits too long may expire before it arrives, so keep the phone charged and connected.
• Allowance. The Free plan includes 50 sign-in codes a day. From Starter at $9 a month, sign-in codes have no daily cap. Prices are before tax.
• Your carrier’s terms apply, because the texts go out over your own mobile plan.

For comparison, Twilio’s pages listed Twilio Verify at $0.05 per successful verification plus $0.0083 per text in the US when we checked in November 2026, and prices differ by country. Twilio, or another SMS API provider, still fits better if you need high volumes, short codes, sender names, US 10DLC numbers or many countries. You can also use both: see SMSTunnel vs Twilio and what texts cost from your own SIM.

Common questions

Do I have to change how my platform makes or checks codes?

No. Supabase, Auth0, Clerk, Better Auth and Ory keep creating, storing and checking the codes. Only the delivery changes.

Can I write the text myself?

Yes. Pass a template with {code} where the code goes. Without one, Auth0 and Clerk send the text they rendered from their own templates.

Can I send codes from more than one phone?

Every phone you link to your account can send. sendCode() and smstunnelSendOTP() take a deviceId to pick one, and the Auth0 Action reads it from the SMSTUNNEL_DEVICE_ID secret. Without one, your default phone sends.

Is the code logged anywhere?

Nothing in the package logs codes or keys. Each webhook handler also remembers recent webhook ids (per running instance), so a retried webhook doesn’t send the same code twice.

A form on your WordPress site is often the first message a new customer sends you: a quote request, a booking, a question about a product. Most form plugins email it to you, and the email waits in an inbox until someone checks. A text lands on the phone that is already in your pocket.

The person who filled in the form wants to know it arrived, too. A short confirmation text, from a number they can call or reply to, does that better than a “thank you” page they close right away.

SMSTunnel does both for five form plugins: Contact Form 7, WPForms, Gravity Forms, Fluent Forms and Forminator. Your site hands each text to your SMSTunnel account, and the SMSTunnel app on your own Android phone sends it from your own number. This guide covers the setup common to all five, then each plugin’s own settings.

Two texts for every form

Every integration below offers the same two texts, and you can use either one or both:

• A text to you or your team when someone submits the form. You can list several numbers; each number gets its own text. Put the answers in it, such as the person’s name, phone and message.
• A confirmation to the person who filled in the form, at the number they entered in it. The add-ons call it SMS (2) or the autoresponder.

The texts go out after each submission that passes the form’s own checks. If your phone is offline for a while, they wait and go out when it is back.

First: link your site to your phone

All five need the free SMSTunnel core plugin, linked to your phone:

1. Install the SMSTunnel app from Google Play on your Android phone and sign in.
2. In WordPress, go to Plugins → Add New, search for SMSTunnel, then Install Now and Activate.
3. Open SMSTunnel → Quick Setup. In the app, open Connections → Link with QR code, scan the code and approve the connection on your phone.

You can also use Connect with API Key in SMSTunnel → Settings, as in the video above. Send yourself a test text from SMSTunnel → Send SMS before you go on: if it arrives, the rest is only form settings. More on the core plugin, including SMS sign-in codes for WordPress logins, is on the core plugin page.

Contact Form 7

Install SMSTunnel for CF7 from Plugins → Add New. Then go to Contact → Contact Forms, edit a form and open its SMS tab (shown to administrators).

• Tick Send SMS notification when this form is submitted, add your number(s) under Recipient Phone Number(s), separated by commas, and write the Message Body.
• For the confirmation, tick Use SMS (2). Its Recipient Phone Number is [your-phone] by default: the visitor’s own phone field. Change the tag if your phone field has another name.

The message can use any field of the form as a mail-tag, like [your-name] or [your-message], plus [_date], [_time], [_site_title], [_site_url], [_post_title] and [_post_url]. Other special mail-tags are not replaced. A useful text to yourself:

New contact from [your-name]: [your-message] - Reply to: [your-phone]

All the details are on the Contact Form 7 page.

WPForms

Install SMSTunnel for WPForms. It is made for WPForms Lite, the free plugin, so you don’t need WPForms Pro. Open the form in the WPForms builder and go to Settings → SMS.

• Turn on Enable SMS notification when form is submitted, add the Recipient Phone Number(s) and edit the Message Body. By default it reads “New form submission from {field_id="1"}”, followed by every answer with {all_fields}.
• Turn on Enable SMS (2) Autoresponder, put the phone field’s smart tag in Recipient Phone Number, like {field_id="3"}, and write the Confirmation Message.

Besides {field_id="X"} and {all_fields}, the smart tags {site_name}, {site_url}, {admin_email}, {user_ip}, {entry_id} and {date format="m/d/Y"} work. Some other WPForms smart tags, like {form_name} and {page_title}, are not replaced. See the WPForms page.

Gravity Forms

Install SMSTunnel Notifications for Gravity Forms, edit a form and open Settings → SMS. Each form has its own SMS settings:

• Enable sends a text when the form is submitted, to the Recipient Phone Number(s). A merge tag works there too, like {Phone:5}.
• The Message Body starts as “New form submission:” followed by {all_fields}. Every Gravity Forms merge tag works, like {Name (First):1.3} or {entry_id}.
• SMS (2) - Autoresponder has its own Enable box, one Recipient Phone Number and a Confirmation Message.

Click Save SMS Settings when you’re done. There is no conditional logic: the texts go out after every submission. More on the Gravity Forms page.

Fluent Forms: built into SMSTunnel

For Fluent Forms you don’t install anything else: since version 1.0.13, the core plugin adds its texts as soon as Fluent Forms is active, and it works with the free version.

Open your form and go to Settings & Integrations → Configure Integrations → Add New Integration. Pick SMSTunnel SMS (the text to you) or SMSTunnel SMS (2) Autoresponder (the confirmation). Give it a name, enter the numbers or pick the form’s phone field, like {inputs.phone}, write the message and click Save Feed.

Use the smartcodes next to the message, like {inputs.name}; {all_data} adds every answer as “Label: value”, one per line. Each text has an Enable this text switch, and you can switch off SMSTunnel texts for all forms in Fluent Forms → Integrations. See the Fluent Forms page.

Forminator: built in too

Forminator also works with the core plugin alone, free version included. Activate SMSTunnel once in Forminator → Integrations: find it under Available Apps, click + and Activate.

Then open your form, go to its Integrations tab and click + next to SMSTunnel. Give the text a name, choose Who gets this text? (SMSTunnel SMS or SMSTunnel SMS (2) Autoresponder), click Next, enter the numbers or pick the form’s phone field, write the message and Save. A form can have several texts.

The message uses the form’s field tags, like {name-1} or {textarea-1}, and {all_fields}, {all_non_empty_fields}, {form_name} and {submission_id}. In the form’s Phone field, set Validation to International. Details on the Forminator page.

Phone numbers: the one rule that matters

Every number needs + and the country code, like +44 7700 900123. Ask for that format in your form’s phone field, in the label or the placeholder, because the plugins don’t add the country code for you:

• Contact Form 7, WPForms and Gravity Forms accept spaces, skip a local number that starts with 0, and read a number without + as if it began with a country code.
• Fluent Forms and Forminator skip numbers without the country code.
• All of them always skip premium-rate numbers; Fluent Forms and Forminator skip short codes too.

Texts longer than 1,600 characters are cut, so {all_fields} on a very long form may not fit.

Other form plugins

SMSTunnel add-ons for Elementor Forms (the Elementor Pro Form widget), Ninja Forms and Formidable Forms are coming to WordPress.org. Each page says how to get one sooner. For a WooCommerce shop, see WooCommerce SMS from your own number.

Common questions

Do I pay per text?

Not to SMSTunnel. The texts go out from your own SIM, so your mobile plan’s SMS rates or allowance apply. The Free plan covers 25 texts a day and 500 a month as written, and paid plans start at $9 a month; see pricing.

Can I text everyone who ever filled in my form?

That’s not what these integrations do. Each submission sends its own texts: one to you or your team, and one confirmation to the person who just filled in the form. Text only people who expect to hear from you.

Can the texts be encrypted?

Yes, optionally. Turn on end-to-end encryption in the core plugin’s settings, and your site encrypts its texts for your phone before they leave WordPress. The end-to-end encryption guide explains what SMSTunnel can and can’t see.

n8n is good at noticing things: a form was submitted, a row changed in a sheet, a workflow failed at 3 a.m., tomorrow’s appointments are ready. Telling a person about it by text message usually means signing up with an SMS API provider, renting a number and paying for every message.

If you have an Android phone with a SIM, there is a shorter route. The SMSTunnel community node for n8n hands each text to your SMSTunnel account, and the SMSTunnel app on your phone sends it from your own number. The people you text see a number they already know, and they can reply to it. SMSTunnel charges no per-message fees: what a text costs is whatever your mobile plan charges for SMS.

This guide sets it up from scratch on the Free plan: link the phone, create a key, install n8n-nodes-smstunnel, and build three workflows you can copy — a form that texts the person who filled it in, an alert when any workflow fails, and reminders the day before an appointment.

What you need

• An Android phone with Android 7.0 or newer and a SIM that can send SMS, online over Wi-Fi or mobile data. A spare phone that stays on the charger works too.
• A free SMSTunnel account. The Free plan includes 25 texts a day and 500 a month sent exactly as you wrote them, up to 25 more texts a day from your own software that end with a short “free by smstunnel.io” line, and 50 sign-in codes a day. Paid plans start at $9 a month; see pricing.
• An n8n where you can install community nodes. This guide and the video use a self-hosted n8n. Where else community nodes can be installed is up to n8n, so check n8n’s page on community nodes. If you can’t install them, the HTTP Request node does the same job with a few more fields.

Step 1: link your phone

1. Create an account at dashboard.smstunnel.io, or continue with Google or Facebook.
2. Install the SMSTunnel app from Google Play on the phone, sign in with the same account and turn on the service. The app explains why it needs to send SMS before Android asks for the permission.
3. The phone now shows up in your dashboard under Phones. You can also link it with a QR code: open Phones → Add phone on your computer and scan the code from the app, under Connections → Link with QR code.

Before you touch n8n, send yourself a test from the dashboard with Write a text. If it arrives, the rest is n8n configuration. The documentation covers the app’s permissions and background service.

Step 2: create a key for n8n

In the dashboard, open Apps → Add an app, choose n8n and copy the key. It is shown only once, so paste it straight into n8n or somewhere safe. The key can send texts and check whether they went out, nothing more. To cut n8n off later, delete the app in the same place.

One operation needs more than that. Get Received reads the texts your phone receives, so it only works with a key you explicitly allowed to read them (Can also read received texts when you create it, or Allow reading received texts later). It also needs Sync received texts turned on in the app. Sync is off by default, only texts that arrive after you turn it on are copied, and your existing inbox is never read.

Step 3: install n8n-nodes-smstunnel

In n8n:

1. Open Settings → Community Nodes.
2. Select Install and enter n8n-nodes-smstunnel.
3. Agree to the risks of using community nodes and select Install.

To install it by hand instead, run this in your n8n installation directory:

npm install n8n-nodes-smstunnel

With Docker, add the package to your custom image or mount it into ~/.n8n/custom. The node is open source, under the MIT license.

Step 4: add the credentials

Create new SMSTunnel API credentials:

Select Test before you save: it checks the key.

Step 5: text the person who filled in a form

This is the workflow from the video: someone fills in a form and gets a text from your number seconds later.

1. Add an n8n Form Trigger with two fields, Name and Phone.
2. Add the SMSTunnel node with resource Message and operation Send.
3. Fill in To and Message with expressions:

To:      {{ $json["Phone"] }}
Message: Thanks {{ $json["Name"] }}, we got your request and will call you back today.

4. Under Additional Fields, set Default Country Code, for example +44. Numbers typed without + or 00 get that code and lose their leading 0, so 07700 900123 goes to +447700900123. It takes precedence over the country set for your phone.
5. Open the form, enter your own number and submit. The text arrives from the phone you linked.

Every text the node sends has exactly one recipient. If ten people fill in the form, n8n runs the node ten times and each person gets their own text.

Two more workflows worth copying

A text when any workflow fails

An SMS reaches you even when the phone in your pocket has no data connection.

1. Create a workflow that starts with an Error Trigger node.
2. Add SMSTunnel → Message → Send, with To set to your own number and this Message:

Workflow {{$json["workflow"]["name"]}} failed: {{$json["execution"]["error"]["message"]}}

3. In the settings of each workflow you want to watch, choose this one as its error workflow.

Reminders the day before an appointment

A Schedule Trigger runs every day at 18:00. A database, Google Sheets or HTTP Request node fetches tomorrow’s appointments, and SMSTunnel → Send texts each person, with To set to {{ $json.phone }}. With Default Country Code set, numbers stored without a prefix still work. Because the reminder comes from your number, people can simply reply to move or cancel, and the reply lands on your phone. If your appointments already live in a spreadsheet or a calendar, the Google Sheets and Calendar guide shows another way to send them.

Sign-in codes, status and replies

The node does more than send:

• Send 2FA Code sends a sign-in code that your workflow generated. The text must contain the code — 4 to 10 digits standing on their own, such as 482913 or 12-345678, or two groups of three digits like 123-456 — and can be up to 320 characters. Codes have their own daily allowance: 50 a day on the Free plan, no daily cap on paid plans. SMSTunnel only delivers the code; your workflow creates it and checks it. There is more in the guide to sign-in codes without Twilio.
• Get Status takes a message ID and tells you whether the text is pending, sent or failed. A failed text marked as unconfirmed was most likely sent, so don’t resend it automatically.
• Get Received returns the texts your phone received, with the permission and the sync from step 2. A scheduled workflow can use it to pick up replies.
• Get Usage shows what you sent today and what is left, and Device → Get Many lists your phones and which of them are online.

Texting a few people at once

Sometimes the same text should reach a handful of people, such as everyone on call this week. Send to Several Recipients takes up to 100 numbers separated by commas, semicolons or new lines, and each recipient gets their own text. It needs the phone to be online when it runs. A plain Send to an offline phone waits instead, and goes out when the phone is back, within 3 days.

Use it rather than a loop of Send: SMSTunnel accepts 30 send requests a minute, and the node doesn’t retry after a “too many requests” answer. Also worth knowing:

• A text can be up to 1600 characters, which the phone sends as up to 10 joined SMS.
• A failed call stops the workflow. Turn on Continue On Fail to get an error field on the item instead, and handle it in the next node.

Keep it to people who expect to hear from you: alerts, reminders, replies and codes.

No community nodes? Use the HTTP Request node

If your n8n can’t install community nodes, the built-in HTTP Request node can call the SMSTunnel API directly:

• method POST and URL https://smstunnel.io/api/v1/sms/send;
• a header X-API-Key with your key, kept in an n8n credential such as Header Auth rather than typed into the node;
• a JSON body with one recipient:

{
  "to": "+447700900123",
  "message": "Your order #1042 is ready for pickup."
}

The answer contains a messageId for checking the status later. Optional fields: deviceId (which of your phones sends it) and defaultCountryCode. The API reference lists every endpoint and error, and the n8n integration page has all the node’s fields.

Common questions

Does it work on the Free plan?

Yes. The node is free, and on the Free plan up to 25 texts a day and 500 a month go out exactly as written; up to 25 more a day end with the short “free by smstunnel.io” line. Paid plans never add anything to your texts.

Whose number do people see?

The number of the SIM in the phone that sends. Replies go to that phone like any other text, and with sync turned on you can also read them in your dashboard.

What if my phone is offline?

A text from Send waits in your account and goes out when the phone is back online, for up to 3 days. Send to Several Recipients needs the phone online.

Push notifications from Home Assistant are great until the moment they matter. The phone you carry has no data connection, battery saver is on, or Android quietly killed the companion app, and the alert about the leak under the sink never shows up. A text message doesn’t need any of that: it reaches the phone in your pocket over the mobile network, with or without mobile data.

The SMSTunnel integration gives Home Assistant a notify.smstunnel service. Your automations hand each alert to your SMSTunnel account, and the SMSTunnel app on your Android phone sends it as an ordinary SMS, from your own number, on your own SIM. There is no third-party SMS provider in between and no per-message fee from SMSTunnel; your mobile plan’s SMS rates apply.

This guide goes from zero to four working automations — a water leak, a power cut, a freezer warming up and a door opening while nobody is home — plus the settings that stop a twitchy sensor from texting you all night.

How the pieces fit together

• The phone that sends is an Android phone (Android 7.0 or newer) with a SIM and the SMSTunnel app, online over Wi-Fi or mobile data. A good fit is an old phone that stays at home on the charger: your alerts then reach the phone you carry as a plain text.
• Home Assistant hands the alert to your SMSTunnel account over the internet, and the app on the phone sends it.
• The recipients are the numbers you choose: yours, your partner’s, a neighbour who has a key. Each recipient gets their own text.

One honest limit: Home Assistant and the sending phone both need an internet connection to hand the alert over. If you want texts during a home internet or power outage, give them a backup — mobile data on the phone, and a UPS (or a mobile-data router) for Home Assistant and your router.

Step 1: link a phone and create a key

1. Create an account at dashboard.smstunnel.io, or continue with Google or Facebook.
2. On the sending phone, install the SMSTunnel app from Google Play, sign in with the same account and turn on the service. The phone appears in your dashboard under Phones; you can also link it by scanning the QR code from Phones → Add phone.
3. In the dashboard, open Apps → Add an app, choose Home Assistant and copy the key. It is shown only once. Deleting the app later cuts Home Assistant off.

Send yourself a test from the dashboard with Write a text. If it arrives, the phone side is done. The documentation explains the app’s permissions and its background service.

Step 2: install the integration

The recommended way is HACS:

1. In HACS, open the three-dot menu and choose Custom repositories.
2. Add https://github.com/narcisbodea/hass-smstunnel with the category Integration.
3. Install SMSTunnel, then restart Home Assistant.

Without HACS, copy the custom_components/smstunnel folder from that repository into your Home Assistant config/custom_components/ folder and restart.

Step 3: add SMSTunnel in Home Assistant

Go to Settings → Devices & Services → Add Integration → SMSTunnel and fill in the form:

These settings can’t be edited later. To change them, remove the integration and add it again.

To test, open Developer tools, call notify.smstunnel with a short message, and wait for the text on your phone. From then on, any automation or script can use it.

Four automations to copy

The examples use the same syntax as the integration’s README. Home Assistant 2024.8 and newer write the call as action: notify.smstunnel instead of service: notify.smstunnel; it is the same service. Replace the entity IDs with your own.

A water leak

The classic case, where minutes cost real money:

automation:
  - alias: "SMS on water leak"
    trigger:
      - platform: state
        entity_id: binary_sensor.basement_water_leak
        to: "on"
    action:
      - service: notify.smstunnel
        data:
          title: "Home Assistant"
          message: "Water leak detected in the basement!"

SMS has no separate title field, so the text arrives as “Home Assistant: Water leak detected in the basement!”.

A power cut

A UPS integration reports when the power goes out. The entity name depends on your UPS; the for: line waits a minute so a short flicker doesn’t text you. Keep the router on the UPS too, or the alert can’t go out.

automation:
  - alias: "SMS when the power goes out"
    trigger:
      - platform: state
        entity_id: binary_sensor.ups_on_battery
        to: "on"
        for: "00:01:00"
    action:
      - service: notify.smstunnel
        data:
          message: "Power cut at home: the UPS is running on battery."

A freezer warming up

Hours of warning instead of a ruined freezer. The message includes the current temperature, and the delay at the end, together with mode: single, allows at most one text an hour:

automation:
  - alias: "SMS when the freezer warms up"
    mode: single
    trigger:
      - platform: numeric_state
        entity_id: sensor.freezer_temperature
        above: -12
        for: "00:15:00"
    action:
      - service: notify.smstunnel
        data:
          message: "Freezer at {{ states('sensor.freezer_temperature') }} °C for 15 minutes."
      - delay: "01:00:00"

The front door opens while nobody is home

This one goes to two people instead of the recipients you saved: target takes one number or a list, and replaces the saved recipients for that call only. The condition uses the home zone, whose state is the number of people at home.

automation:
  - alias: "SMS when the front door opens and nobody is home"
    trigger:
      - platform: state
        entity_id: binary_sensor.front_door
        to: "on"
    condition:
      - condition: state
        entity_id: zone.home
        state: "0"
    action:
      - service: notify.smstunnel
        data:
          message: "The front door just opened and nobody is home."
          target:
            - "+447700900123"
            - "+447700900456"

For a single call you can also pick another phone or country code, under the service’s own data:

service: notify.smstunnel
data:
  message: "Test from the phone in the garage"
  data:
    device_id: "your-phone-id"
    default_country_code: "+44"

Keep a twitchy sensor from texting you all night

A sensor that flips between on and off can fire an automation dozens of times in a few minutes, and every run is a text. That burns through your allowance and tries your carrier’s patience. Three habits prevent it:

• Add for: to the trigger, so the state must hold for a while before anything is sent.
• Add a condition that only lets the alert through when it matters, like the empty-house check above.
• Add a cooldown with mode: single and a delay at the end, as in the freezer example.

The numbers to keep in mind: the Free plan sends 25 texts a day and 500 a month exactly as written, and up to 25 more a day end with a short “free by smstunnel.io” line. Paid plans start at $9 a month, with higher daily limits; see pricing. On every plan, SMSTunnel accepts 30 send requests a minute.

When something goes wrong

The integration is built so that one problem doesn’t hide another:

• Errors go to the Home Assistant log, not to the automation, so the rest of the automation still runs.
• One failed recipient doesn’t block the others: the remaining texts still go out.
• Past 30 requests a minute, the text is not sent and the log says so plainly. There is no automatic retry.
• Texts longer than 1600 characters are cut before sending, rather than refused.
• If the sending phone is offline, the text waits in your account and goes out when the phone is back.

Removing the integration stops notify.smstunnel at once, without a restart, and deleting its app in the dashboard stops the key.

Common questions

Which number do the alerts come from?

From the SIM in the phone that runs the SMSTunnel app. Recipients can save it as “Home” and recognise it at a glance.

Can people reply?

Yes. Replies reach the sending phone like any other text, and with sync turned on in the app you can read them in your dashboard too. The integration itself only sends.

Does Home Assistant need to be reachable from the internet?

The integration calls SMSTunnel from Home Assistant, so Home Assistant needs a way out to the internet. It doesn’t need to accept connections from outside.

Is there an alternative without Home Assistant?

For servers and monitoring tools, the guide to monitoring alerts by SMS covers Uptime Kuma, Grafana and Zabbix. For other workflows, n8n works the same way. Everything about the integration itself is on the Home Assistant integration page.

Google Calendar stopped sending SMS notifications on 7 January 2019. Since then its reminders come as app and email notifications only, which are easy to miss when you are driving, in a meeting or away from your inbox. A text is harder to miss, and it also reaches people who don’t use Google Calendar at all, like the clients in your appointments.

SMSTunnel brings text reminders back, and adds texts from your spreadsheets. Free Google Apps Script templates hand each text to your SMSTunnel account, and your own Android phone sends it from your own number. The people you text see a number they know, and they can reply to you. There is no server to run: everything lives in Apps Script, inside your own spreadsheet.

What you can text from Google

There are four ready templates, plus a small library for your own code:

Every template sends one text per number, only to the numbers it was set up for, with a cap per run, and never the same text twice. There is no button that texts everyone in a sheet, on purpose.

What you need

• An Android phone with the SMSTunnel app from Google Play, signed in to your account. The video above shows the setup.
• A Google account. Personal accounts and Google Workspace accounts both work, and Apps Script is free with either.
• An SMSTunnel key. In your dashboard, open Apps → Add an app, pick Script or server, name it (for example “Google Sheets”) and click Create the key. Copy it right away: it is shown only once. Make one key per spreadsheet or form, so you can stop one without touching the others.

Step 1: add a template to your spreadsheet

One-click copies of the templates (Make a copy) are coming soon. Today you paste the code from the smstunnel-google repository on GitHub, which takes a few minutes:

1. Open the spreadsheet: your data for Google Sheets, or a new one for Google Calendar (it keeps the log and, if you want, your guests’ numbers). Then choose Extensions → Apps Script.
2. In the repository, open the template’s folder: apps-script/calendar-reminders, apps-script/sheets-status-texts or apps-script/sheets-reminders. Make the same files in the editor and paste each one’s content: SmsTunnel, SmsTunnelKit and Code as script files (+ → Script), and Setup as an HTML file (+ → HTML).
3. Open Project Settings (the gear), tick Show “appsscript.json” manifest file in editor, open appsscript.json and replace it with the template’s.
4. Save, go back to your spreadsheet and reload it. The SMSTunnel menu shows up after a few seconds.

For a form, the editor is under ⋮ (More) → Apps Script in the form’s editor, and the folder is apps-script/forms-text-me. People who fill in the form never see the menu.

Step 2: set it up and send a test

Choose SMSTunnel → Set up. The first time, Google asks you to allow the script and, because it is your own copy of a script Google hasn’t reviewed, shows “Google hasn’t verified this app”. That is expected: click Advanced → Go to … (unsafe). Tick all the permissions: the script calls only smstunnel.io, works in this spreadsheet only, reads your calendars without ever changing them, and runs its triggers while you are away.

Then paste your key, click Check, choose the phone that sends the texts, fill in the rest and click Save and turn on. Finish with a test to yourself: SMSTunnel → Send a test text, or Send me a test reminder in the Calendar template.

Google Calendar: three kinds of reminders

Set up has three parts. Turn on the ones you want.

Remind me before each event

A text to your own numbers (up to 5, one text each) 10, 15, 30 or 45 minutes, 1 to 12 hours, or a day before each event in the calendars you choose. You can limit it to events whose title has a word you choose, like “dentist”. All-day events are left out unless you include them. A reminder reads like this:

Reminder: Dentist at 2:30 PM (in 15 min)

Your agenda every morning

One text a day at the hour you choose, such as “Today, Mon, Nov 2: 9:00 AM Dentist, 2:00 PM Call with Ana”. Days with nothing planned are skipped unless you say otherwise.

Remind the people in your appointments

This is the one for practices, salons and anyone who books clients. The number comes from a line in the event’s description that starts with a word you choose and a colon, such as SMS: +1 415 555 0123, or from a Phone numbers sheet for guests you invited. Other numbers in a description, such as a video call’s dial-in line, are never used.

By default only events you created count, so an invitation from someone else can’t choose who gets a text from your phone. Reminders to people go out only between the hours you choose (8:00 to 21:00 by default), to at most 10 people per event. Texts can use {Title}, {Date}, {Time}, {Location}, {Calendar}, {In} and, for people, {Name}.

Each reminder goes out once. A hidden SMSTunnel sent sheet records every text, and if an event moves, its new time gets one new text. Preview the next texts shows what would go out in the next 24 hours without sending anything.

Google Sheets: status texts and appointment reminders

A text when a row’s status changes

Choose the sheet, the status column, the value that triggers the text and the phone column, then write the text with the row’s columns as placeholders:

Hi {Name}, your order {Order} has shipped.

When someone sets a row’s status to that value, the number in that row gets the text, and a Texted at column shows when. A row is never texted twice, and rows that already had the value at setup are skipped, so only changes from now on send texts.

Pasting the value into many rows sends at most 20 texts at once (you can raise that to 50); the rest wait. Edits made by other apps or scripts don’t fire Google’s edit trigger, so tick Also check every 15 minutes if your sheet is filled in by another tool.

Appointment reminders from a sheet

Choose the phone column, the date column and, if the time has its own column, the time column. Dates can be real dates or text like 2026-11-02 14:30, read in the spreadsheet’s time zone (File → Settings). Every hour, each row whose appointment falls within the next hours you choose (24 by default) gets one reminder, between 8:00 and 21:00 by default, at most 25 per run. Reminder sent records it, and a row without a valid number is marked Not sent with the reason.

Your own Apps Script code

Developers can paste apps-script/library/SmsTunnel.js into any Apps Script project and call it directly. Save the key once with SmsTunnel.setApiKey(), which keeps it in your user properties, then send:

// Text the number in the row you are on.
function textThisRow() {
  var sheet = SpreadsheetApp.getActiveSheet();
  var row = sheet.getActiveRange().getRow();
  var phone = SmsTunnel.normalizePhone(sheet.getRange(row, 2).getDisplayValue(), '+1');
  if (!phone.ok) throw new Error(phone.message);
  var result = SmsTunnel.sendSms(phone.number, 'Your order is ready for pickup.');
  sheet.getRange(row, 5).setValue(result.queued ? 'Waiting for my phone' : 'Texted');
}

One number per call: to text several people, call sendSms once for each. The Google Sheets guide lists the other functions and their errors.

Limits worth knowing

• Numbers go in international format, like +14155550123. Format → Number → Plain text keeps the + in a cell. A number without a country code is skipped unless you set one in Set up → More settings, so a text never goes to the wrong country.
• SMSTunnel takes 30 send requests a minute and up to 1600 characters per text, and your plan’s daily allowance applies. The templates pause 2 seconds between texts and cap each run.
• Google’s quotas: a free Google account gets 20,000 URL Fetch calls a day (one per text) and 90 minutes of trigger run time a day; Workspace accounts get more.
• If your phone is offline, the text waits in your account and goes out as soon as the phone is back online.
• Your key stays in the script’s user properties, never in a cell or a log. Anyone with edit access to the spreadsheet can edit its script, so share it only with people you trust. Deleting the key under Apps in your dashboard stops every text at once.

Common questions

Does it cost anything?

The templates are free, and so is Apps Script. The texts count against your SMSTunnel plan, and your mobile plan applies to the texts your phone sends. The Free plan covers 25 texts a day and 500 a month exactly as written, which is plenty for personal reminders; Starter, at $9 a month, allows 300 texts a day for a busy appointment book.

Whose number do people see?

Yours. The texts leave your own phone, from its SIM, like a text you type yourself, and replies come back to your phone.

My calendar is in Outlook. What then?

See reminder texts for Outlook Calendar, built with n8n, Power Automate, Zapier or Make.

Can an AI assistant send the reminders instead?

Yes, when you ask: with the SMSTunnel MCP server and a calendar connector, an assistant like Claude can text tomorrow’s clients after showing you the list. It doesn’t run on a schedule, though, so for reminders that go out on their own, use the Calendar template.

An alert only helps if it reaches someone. A text still gets through when an email or a push notification doesn’t, and it arrives from a number the on-call person knows and can call back.

With SMSTunnel, your monitoring tools hand each alert to your SMSTunnel account, and your own Android phone texts it from its own SIM. There is no GSM modem to plug into a server and no SMS provider in between: each alert is an ordinary text on your phone’s plan. This guide sets up four common tools, Uptime Kuma, Grafana, Zabbix and GitHub Actions, and a webhook address for everything else.

Before you start: one key per tool

Install the SMSTunnel app from Google Play on an Android phone and sign in; the video above takes you through it. Then, in your dashboard, open Apps → Add an app, pick Script or server, name it after the tool (for example “Uptime Kuma”) and click Create the key. Copy the key right away: it’s shown only once.

Give each tool its own app. If a key leaks from one tool’s settings, you delete that app and only that tool stops texting.

Under the hood, all four tools make the same call: a POST to the Send a Text endpoint with the key in an X-API-Key header and one number per request:

curl -X POST https://smstunnel.io/api/v1/sms/send \
  -H "X-API-Key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"to": "+14155550123", "message": "web-01 is down"}'

Numbers go in international format, with + and the country code. For two people, you make two requests: everyone gets their own text.

Uptime Kuma: the built-in Webhook notification

Uptime Kuma needs no plugin. Open Settings → Notifications → Set Up Notification, choose the Webhook type, give it a name like “SMS to me”, and fill in:

• Post URL: https://smstunnel.io/api/v1/sms/send, with HTTP Method POST if your version shows the field;
• Request Body: Custom Body, with your number in to;
• Additional Headers: turned on, with your key.

{"to": "+14155550123", "message": {{ msg | json }}}

{"Content-Type": "application/json", "X-API-Key": "sk_live_..."}

Keep {{ msg | json }} exactly as it is: it puts Uptime Kuma’s alert in the text, with the quotes JSON needs. Click Test and your phone texts <Friendly Name> Testing; a wrong key shows a 401 “Invalid or expired API key”. Click Save, then tick the notification in each monitor’s Notifications list, or use Default enabled and Apply on all existing monitors. For several people, add one Webhook notification per number.

The texts look like this:

[My shop] [🔴 Down] timeout of 48000ms exceeded
[My shop] [✅ Up] 200 - OK

A monitor that keeps flapping sends a text every time, so set Retries so that a short blip isn’t reported as down.

No key in Uptime Kuma at all? A webhook address works too: in your dashboard, open Apps → Webhooks → New webhook and pick Uptime Kuma, which sets the webhook’s text to {{msg}}. Then make the address the notification’s Post URL, with Request Body on Preset - application/json and no headers; one notification texts all the webhook’s numbers, up to 10. The Uptime Kuma guide has both ways.

Grafana: a webhook contact point

On Grafana 12 or newer, open Alerts & IRM → Alerting → Notification configuration → Contact points, click + Add contact point and choose the Webhook integration. Set the URL to https://smstunnel.io/api/v1/sms/send. Under Optional Webhook settings, choose HTTP Method POST and add an Extra Headers entry named X-API-Key with your key as the value. Then paste this into Custom Payload → Payload Template:

{{ coll.Dict
  "to" "+14155550123"
  "message" (printf "%s %s" (tmpl.Exec "default.title" .) (index .Alerts 0).Annotations.summary)
  | data.ToJSON }}

coll.Dict … | data.ToJSON writes the JSON for you, so quotes and colons in an alert can’t break it. Leave the Authorization and Basic Authentication fields empty, click Test, then Save contact point, and pick it in an alert rule or in Notification policies. A text reads like [FIRING:1] DiskFull nas1 Disk 95% full: /volume1, and again with [RESOLVED] when the alert clears.

Two things worth knowing. A firing alert texts again at every repeat interval, 4 hours by default, and once more when it resolves unless you tick Disable resolved message. And Grafana doesn’t mask Extra Headers: anyone who can edit the contact point can read the key, which is one more reason to give Grafana its own app.

Easier still, on any Grafana version and on Grafana Cloud: put a webhook address in the contact point’s URL and leave everything else as it is, with no key and no payload template (see the webhook section below). SMSTunnel reads Grafana’s own alert JSON and texts [FIRING] DiskFull - Disk 95% full: /volume1 to the webhook’s numbers.

Zabbix: a media type instead of a GSM modem

Zabbix’s built-in SMS needs a GSM modem on a serial port of the server. The SMSTunnel media type needs only HTTPS, so it works the same on bare metal, in a VM, in Docker or in the cloud, for Zabbix 6.0 LTS, 7.0 LTS and later. Zabbix 6.0 has some of the menus elsewhere; they’re in brackets.

1. Download media_smstunnel.yaml, or media_smstunnel_6.0.yaml for Zabbix 6.0, and import it in Alerts → Media types → Import (6.0: Administration → Media types → Import).
2. In Administration → Macros (6.0: Administration → General → Macros), add {$SMSTUNNEL.API.KEY} with your key and set its type to Secret text, so it’s hidden in the frontend and left out of exports.
3. Click Test in the SMSTunnel row and put your own number in send_to. The Test window doesn’t fill in macros, so paste the key into api_key for that test only.
4. Give each user their own number: in Users → Users (6.0: Administration → Users), open the user, then Media → Add, type SMSTunnel, with the number in Send to in international format.
5. In Alerts → Actions → Trigger actions (6.0: Configuration → Actions → Trigger actions), add an operation that sends to users or user groups, with Send only to: SMSTunnel.

The media type brings message templates written to be read on a phone, and cuts texts at 320 characters:

PROBLEM: High CPU utilization (over 90% for 5m)
Host: web-01
Severity: High
Data: Current utilization: 97.3 %
Started: 2026.11.01 10:00:00
ID: 123456

A busy moment or a short outage is retried for about two minutes (5 attempts, 30 seconds apart). Only the Zabbix server sends alerts, not a Zabbix proxy, so it’s the one that needs to reach smstunnel.io on port 443.

GitHub Actions: a text when a deployment fails

Save the key as the repository secret SMSTUNNEL_API_KEY (Settings → Secrets and variables → Actions). In a public repository, save your number as a secret too, such as ALERT_PHONE, because workflow files and logs are public. Then add a step that runs only when the job fails:

- name: Text me if it failed
  if: failure()
  uses: narcisbodea/smstunnel-action@v1
  with:
    api-key: ${{ secrets.SMSTUNNEL_API_KEY }}
    to: ${{ secrets.ALERT_PHONE }}
    message: "Deploy of ${{ github.repository }} failed at ${{ github.sha }}: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

Several numbers in to, separated by commas or new lines, get one text each (at most 30). GitHub gives no secrets to workflows that run for pull requests from forks or for Dependabot, so skip the step there, and don’t switch to pull_request_target to get around it. If a failed text shouldn’t fail your deployment, add continue-on-error: true. The GitHub Actions guide has release and nightly-job examples.

Everything else: a webhook address

Some tools can’t set a header or their own JSON body. For them, SMSTunnel has webhooks: a secret address that texts the numbers you saved with it (1 to 10, one text each). The call sets only the words, never the number, so it needs no key, and a leaked address can’t text anyone new.

You make one in your dashboard: open Apps → Webhooks → New webhook, pick the tool that will call it (Grafana, Uptime Kuma, Healthchecks, Gatus, Alertmanager, Odoo Online, or Something else), add your numbers, click Create the webhook and copy the address. The dashboard then shows that tool’s steps with the address already in them, and Send a test. You can copy the address again anytime, and New address replaces it if it ever leaks.

A GET with ?message= or a POST with a message field both work; texts are cut at 480 characters. Each webhook takes 20 calls an hour unless you raise it (up to 500), and the limit counts calls, not texts: each call texts every number of the webhook. Prometheus Alertmanager and Grafana alerts are read without any template; for Uptime Kuma, picking it sets the text to {{msg}}, so the monitor’s name doesn’t show twice. A crontab line, for example:

0 3 * * * /opt/backup.sh || curl -s -X POST https://smstunnel.io/api/v1/webhook/<token> -H 'Content-Type: application/json' -d '{"message":"Nightly backup FAILED"}'

Scripts can make webhooks with the API too; the webhooks guide shows how. There are ready guides for Prometheus Alertmanager, Healthchecks.io, Gatus and Odoo Online, and, with a key, for Proxmox and Synology.

Limits worth knowing

• 30 send requests a minute. Beyond that SMSTunnel answers 429, and each tool logs it or retries. Group your alerts so a storm becomes one text.
• Length. A text can be up to 1600 characters. An emoji makes an SMS hold 70 characters instead of 160, and Uptime Kuma puts one in each alert, so a longer alert goes out as several joined parts.
• The phone must be on and online. If it isn’t, the text waits in your account and goes out when the phone is back, for up to 3 days. If an alert must never depend on one phone being on and online, an SMS API provider fits that alert better.
• Plans. The Free plan covers 25 texts a day and 500 a month as written, plus up to 25 more a day ending with a short “free by smstunnel.io” line. Starter ($9 a month, before tax) allows 300 a day, Standard ($19) 2,000, and Professional ($39) has no daily cap.

Common questions

Do I need a GSM modem or an SMS provider?

No. The texts leave your own phone, on the plan you already pay for, from a number people recognize.

Can several people get the same alert?

Yes, one text each: one Uptime Kuma notification, Grafana integration or Zabbix media per number, up to 30 numbers in the GitHub Action’s to, or one webhook address with up to 10 numbers.

Where should the key live?

Where only admins can read it: Zabbix’s Secret text macro, a GitHub repository secret, the notification settings of Uptime Kuma or Grafana. Deleting the tool’s app in your dashboard cuts it off at once.

“Text Ana that I’m running ten minutes late.” Typed into Claude, that sentence can become a real text from your own number. The SMSTunnel MCP server gives Claude Desktop, Claude Code, Cursor and VS Code a few tools: the assistant hands the text to your SMSTunnel account, and the SMSTunnel app on your Android phone sends it from its own SIM. Ana sees a number she knows, and she can reply.

The server is published: the package @narcisbodea/smstunnel-mcp on npm, the entry io.github.narcisbodea/smstunnel-mcp in the MCP Registry, and the source code on GitHub under the MIT license. The MCP server page has the same setup on one screen.

This guide sets it up in a few minutes and explains the rules built into it: you approve each text, every text goes to one person, and texts you receive are treated as data, never as instructions.

What the assistant can do

MCP, the Model Context Protocol, is an open standard that lets AI apps use outside tools. The SMSTunnel server adds six:

Every tool carries the MCP annotations that say whether it only reads or also changes something, so AI apps that support them can ask you before anything is sent.

Step 1: link your phone and create a key

1. Install the SMSTunnel app from Google Play on your Android phone and sign in. Sign in to your dashboard on your computer with the same account: the phone appears under Phones.
2. In the dashboard, open Apps → Add an app and copy its key. It is shown only once, and it can send texts and look up whether they went out.
3. Optional: to let the assistant read the texts you receive, turn on Can also read received texts when you add the app, and turn on syncing of received texts in the SMSTunnel app. Syncing is off by default, and only texts that arrive after you turn it on are synced.

Step 2: add the server to your AI app

You need Node.js 20 or newer. Your AI app starts the server with npx; you don’t run it yourself.

Claude Desktop and Cursor

In Claude Desktop, open Settings → Developer → Edit Config (claude_desktop_config.json), add the server, then quit and restart Claude. Cursor takes the same block in ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project).

{
  "mcpServers": {
    "smstunnel": {
      "command": "npx",
      "args": ["-y", "@narcisbodea/smstunnel-mcp"],
      "env": {
        "SMSTUNNEL_API_KEY": "sk_live_your_key"
      }
    }
  }
}

On Windows, if the app can’t start npx, use "command": "cmd" and "args": ["/c", "npx", "-y", "@narcisbodea/smstunnel-mcp"].

Claude Code

claude mcp add --env SMSTUNNEL_API_KEY=sk_live_your_key --transport stdio --scope user smstunnel -- npx -y @narcisbodea/smstunnel-mcp

Run /mcp in Claude Code to check that smstunnel is connected.

VS Code

In .vscode/mcp.json, VS Code asks for the key once and keeps it out of the file:

{
  "inputs": [
    { "type": "promptString", "id": "smstunnel-api-key", "description": "SMSTunnel API key", "password": true }
  ],
  "servers": {
    "smstunnel": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@narcisbodea/smstunnel-mcp"],
      "env": { "SMSTUNNEL_API_KEY": "${input:smstunnel-api-key}" }
    }
  }
}

The settings

All settings go in the server’s env:

Step 3: try it

Start with your own number, then try things like these:

• “Text +14155550123: the delivery is at the back door.”
• “Did my last text go out?”
• “Which of my phones are online?”
• “How many texts do I have left today?”
• “Did anyone reply to me since this morning?” (with received texts allowed)

Before sending, the assistant shows you the number and the exact words and waits for your OK. Once the text is handed to your account, it gets a message ID and can tell you later whether the text went out.

Calendar reminders, when you ask

Put SMSTunnel next to your calendar in the same AI app, and the assistant can read your appointments and text reminders from your own number. In Claude, open Customize → Connectors and connect Google Calendar, or Microsoft 365 for an Outlook calendar on a work or school account. Then ask:

“Look at my calendar for tomorrow and text each client with an appointment a reminder with the time. Show me the list first.”

The assistant reads the events, finds each client’s number and shows you the whole list: each person, their number and the exact text. After your OK it sends one text per person, and it never resends a failed text on its own. Keep each client’s number in the event, with + and the country code, so the assistant can find it. Calendar events can also come from other people’s invitations, so read the list before you approve it.

The assistant acts when you ask; it doesn’t run on a schedule. For reminders that go out on their own, use the free Google Calendar template (Google Calendar stopped its own SMS notifications in January 2019) or the Outlook Calendar recipes for n8n, Power Automate, Zapier or Make.

The rules built into the server

An assistant that can send texts needs clear limits. These are part of the server, not just advice:

• You approve each text. The tools tell the assistant to show you the number and the words, or the whole list for several people, and to wait for your OK. With SMSTUNNEL_CONFIRM_EACH_TEXT left on, Claude Code asks before every single text, even in modes that otherwise run tools on their own.
• One recipient per text. There is no tool for several numbers: the assistant sends one text per person, about 30 a minute at most.
• No blind resends. A failed or unconfirmed text may still have gone out, so the assistant asks you instead of sending it again.
• Received texts are data. Anyone can text your phone, so the assistant treats their words as information, never as instructions. Turn reading on only if you need it.
• Your key stays in your AI app’s settings, never in a chat, a repository or a web page. Delete the app under Apps in your dashboard to cut it off at once.
• Only texts people expect: replies, reminders, alerts to yourself, sign-in codes.

One more thing to know: texts sent through the MCP server are kept on your dashboard’s Messages page, like texts from your other apps. The server doesn’t encrypt them end to end; if you need that for texts from your own software, see how end-to-end encryption works.

What about ChatGPT?

ChatGPT connects only to MCP servers on the internet, over HTTPS, so it can’t start this server on your computer. Use Claude Desktop, Claude Code, Cursor or VS Code. If you’d rather write your own code, the same things are one HTTPS call away in the API reference.

Common questions

What does it cost?

The MCP server itself is free and open source. The texts count toward your SMSTunnel plan like texts from any of your apps. The Free plan includes 25 texts a day and 500 a month as you wrote them, plus up to 25 more a day that end with a short “free by smstunnel.io” line, and 50 sign-in codes a day. Paid plans start at $9 a month, before tax: see Pricing. Your mobile plan’s SMS charges or allowance apply, because your own SIM sends the texts.

Can the assistant text several people?

Yes, one person at a time: it shows you everyone it will text first, and after your OK it sends one text to each number. There is no call that sends one text to many numbers.

Which phone sends the text?

Any phone linked to your account can. Set SMSTUNNEL_DEVICE_ID to the ID of the phone you want by default, or ask the assistant to use a particular phone: it can list your phones with their IDs and use the one you name.

Can I stop it?

Yes, at any time. Delete the app under Apps in your dashboard, and its key can’t send texts anymore. You can also remove the server from your AI app’s settings.