Add SMS to a Bolt app: server functions, secrets and replies from your own phone

What you need

• A Bolt project with Bolt Cloud enabled, so the database panel shows Secrets and Server Functions. The project owner or a team admin manages secrets.
• A textbee account with the Android app installed on the phone that holds the SIM, and an API key from the dashboard.
• A second phone, or a friend, to text the textbee phone when you test replies.
• The textbee app on the phone. Download the app, then create an API key in the dashboard.

Send SMS from Bolt

Bolt server functions run on Deno on the Supabase backend that Bolt Database uses. They read secrets from the environment, which keeps the textbee key out of the browser.

1. 1

   Add the secret

   Click the database icon at the top center, open Secrets, enter the name and value, and click Save. Bolt also links to this tab when code it wrote needs a key.

   Field	Value
   Name	TEXTBEE_API_KEY
   Value	Your key from the textbee dashboard

2. 2

   Prompt for the function

   Paste the prompt from this page and change What I want. Bolt writes a server function like the one below and deploys it.

   supabase/functions/send-sms/index.ts

   Copy

   Deno.serve(async (req) => {
     const { to, message } = await req.json()
     const res = await fetch('https://api.textbee.dev/api/v1/gateway/send-sms', {
       method: 'POST',
       headers: {
         'x-api-key': Deno.env.get('TEXTBEE_API_KEY') ?? '',
         'Content-Type': 'application/json',
       },
       body: JSON.stringify({ recipients: [to], message }),
     })
     return new Response(await res.text(), {
       status: res.status,
       headers: { 'Content-Type': 'application/json' },
     })
   })

3. 3

   Protect the function

   A public send function lets anyone text from your phone. Ask Bolt to accept calls only from signed-in users, or to build the message on the server from a booking id instead of taking any text from the browser.

4. 4

   Test and read the logs

   Trigger the function from the preview with your own number. In the database panel, Server Functions and View Logs show the textbee response: data.success true and an smsBatchId.

Receive SMS in Bolt

A second server function receives replies. It must accept requests without a Supabase login token, because textbee signs its requests with X-Signature instead.

1. 1

   Prompt for the webhook function

   Ask Bolt for a function that reads the raw body, checks X-Signature with TEXTBEE_WEBHOOK_SECRET, skips repeated idempotencyKey values and stores the reply. Tell it the function must not require a Supabase JWT.

   supabase/functions/textbee-webhook/index.ts

   Copy

   async function signatureMatches(raw: string, signature: string | null): Promise<boolean> {
     const secret = Deno.env.get('TEXTBEE_WEBHOOK_SECRET') ?? ''
     const key = await crypto.subtle.importKey(
       'raw',
       new TextEncoder().encode(secret),
       { name: 'HMAC', hash: 'SHA-256' },
       false,
       ['sign'],
     )
     const mac = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(raw))
     const expected = Array.from(new Uint8Array(mac), (b) => b.toString(16).padStart(2, '0')).join('')
     if (!signature || signature.length !== expected.length) return false
     let diff = 0
     for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ signature.charCodeAt(i)
     return diff === 0
   }
   
   Deno.serve(async (req) => {
     const raw = await req.text()
     if (!(await signatureMatches(raw, req.headers.get('x-signature')))) {
       return new Response('invalid signature', { status: 401 })
     }
     const event = JSON.parse(raw)
     if (event.webhookEvent === 'MESSAGE_RECEIVED') {
       // save event.sender, event.message, event.receivedAt
     }
     return new Response('ok')
   })

2. 2

   Get the function URL

   Bolt does not print a URL format in its docs, so ask in the chat: "What is the public URL of the textbee-webhook function?" Supabase-backed functions usually answer at https://<ref>.supabase.co/functions/v1/textbee-webhook.

3. 3

   Register the webhook

   In the textbee dashboard open Webhooks, add the URL, pick MESSAGE_RECEIVED and use the same signing secret you saved in Bolt Secrets. Text the phone and watch View Logs.

Paste this prompt into Bolt

The prompt below carries the endpoints, the payloads, where the key may live and the Bolt details from this page. Change the line that starts with What I want, and Bolt builds the feature without guessing an endpoint.

Add SMS to the app I am building in Bolt. Use textbee, an SMS gateway that sends and receives SMS through my own Android phone.

Facts about the textbee API. Use only these. Do not invent endpoints or fields.
- Send an SMS: POST https://api.textbee.dev/api/v1/gateway/send-sms with the header x-api-key: <TEXTBEE_API_KEY> and a JSON body like {"recipients": ["+12015550123"], "message": "Hello"}. recipients must be a JSON array of E.164 numbers, even for one number. Optional fields: deviceId, simSubscriptionId, scheduledAt (ISO 8601, in the future). The response is {"data": {"success": true, "smsBatchId": "..."}}.
- Check delivery or read replies: GET https://api.textbee.dev/api/v1/gateway/messages with the same header. Filters: direction=received, smsBatchId=<id from the send>, from and to as ISO timestamps. Each row has a status such as sent, delivered, failed or received.
- Receive an SMS: textbee posts JSON to a webhook URL I register in the dashboard. A MESSAGE_RECEIVED delivery has these top-level fields: smsId, message, deviceId, webhookSubscriptionId, webhookEvent, idempotencyKey, sender, receivedAt. The header X-Signature holds an HMAC-SHA256 hex digest of the raw body, keyed with the signing secret I set on the webhook. Retries reuse the same idempotencyKey.
- Limits: One Android phone sends roughly 10 to 15 messages a minute. Text only, no MMS. Messages over 160 characters are split into segments.

Rules:
- Store the API key as a secret named TEXTBEE_API_KEY. Call textbee only from server-side code, never from code that runs in the browser.
- Do not ask me to paste the real key into this chat. Tell me where to add the secret instead.
- For incoming texts, create a public server endpoint, check the X-Signature header against a secret named TEXTBEE_WEBHOOK_SECRET, and ignore a repeated idempotencyKey.

What I want: Text the shop owner when a new order is placed, and text the customer when the order is ready for pickup.

Bolt specifics you should know:
- Write the textbee calls as Bolt server functions (Deno). Read secrets with Deno.env.get.
- Secrets live in the database panel under Secrets. Tell me the exact names to add there.
- The webhook function receives requests from textbee, not from a signed-in user, so it must not require a Supabase JWT.
- For Supabase phone sign-in, a Send SMS Hook can call a server function that sends the code through textbee.

Build it, tell me where to add each secret in Bolt, and add a way to send one test message to my own number.

Features to build

Order texts

A database trigger or the checkout code calls the send function with an order id. The function looks up the phone number on the server, so the browser never chooses who gets texted.

Phone login codes

Supabase Auth can hand every login code to a Send SMS Hook. Point the hook at a server function that forwards sms.otp to textbee and returns an empty 200.

Waitlist and pickup

A Ready button on an admin page texts the next person in line. Their reply YES or NO arrives at the webhook function and updates the queue.

Daily digest

A scheduled function counts yesterday's signups or sales and texts the owner one line each morning.

Why Bolt builders text from their own phone

Ship before the paperwork

A Bolt app can go from prompt to published in an hour. Sender registration with a cloud provider can take days. textbee sends from your phone today, and you can move to a registered provider later by changing one function.

Cheap login codes

Verification products bill per successful code on top of the SMS fee. With textbee, each code is one message from the plan allowance, sent through the Send SMS Hook.

One number for the whole shop

Order texts and pickup texts come from the number customers already call, and replies come back to the same function that sent them.

A cloud SMS provider in Bolt vs textbee in Bolt

Per-message prices by provider and country, with sources and dates, are on the provider comparison pages.

What works and what does not

What Bolt charges

Bolt Free includes 1M tokens a month with a 300K daily cap. Pro is $25 a month, or $18 a month billed annually, with 10M tokens. Connecting your own Supabase project directly needs Pro or Teams. bolt.new, checked on October 22, 2026. textbee itself charges a flat monthly plan with messages included; see pricing.

Frequently asked questions

Sources

1. bolt.new, checked on October 22, 2026
2. support.bolt.new: Secrets, checked on October 22, 2026
3. support.bolt.new: Server functions, checked on October 22, 2026
4. support.bolt.new: MCP connectors, checked on October 22, 2026
5. supabase.com: Send SMS Hook, checked on October 22, 2026

Read next

• Order and delivery notifications with SMS from your own Android number
• SMS OTP and verification API: text verification codes from your own number
• Build with AI: one prompt for every builder
• Webhook signature check
• Add SMS to a v0 app: Next.js route handlers that text from your own phone
• Add SMS to a Replit app: Secrets, a server route and a published webhook URL
• All integrations