Add SMS to a Replit app: Secrets, a server route and a published webhook URL

What you need

• A Replit App with a server, such as Node with Express or Python with Flask. Static deployments cannot read secrets.
• A textbee account with the Android app installed on the phone that holds the SIM, and an API key from the dashboard.
• A published app for replies. The free Starter plan includes one published app; Core removes the limit.
• The textbee app on the phone. Download the app, then create an API key in the dashboard.

Send SMS from Replit

Replit Agent asks for API keys when its code needs them and stores them as Secrets. Secrets reach your code as environment variables, so a Node server reads process.env.TEXTBEE_API_KEY.

1. 1

   Add the secret

   Select Tools at the top, then Secrets in the Setup section. Click New Secret, enter the key and value, then Add Secret. To share one key across apps, add it under Account Settings, Account Secrets and link it to the app.

   Field	Value
   Key	TEXTBEE_API_KEY
   Value	Your key from the textbee dashboard

2. 2

   Ask Agent for the route

   Paste the prompt from this page into Agent. In a Node app it writes a route like this one.

   server.js

   Copy

   app.post('/api/sms', express.json(), async (req, res) => {
     const { to, message } = req.body
     const reply = await fetch('https://api.textbee.dev/api/v1/gateway/send-sms', {
       method: 'POST',
       headers: {
         'x-api-key': process.env.TEXTBEE_API_KEY,
         'Content-Type': 'application/json',
       },
       body: JSON.stringify({ recipients: [to], message }),
     })
     res.status(reply.status).json(await reply.json())
   })

3. 3

   Test from the workspace

   Run the app and send to your own number from the preview pane. The route returns data.success true. If it returns 401, the secret name in code and in Secrets differ.

Receive SMS in Replit

The dev URL only lives while you work in the app, is private by default and can change each time you reopen it. Publish the app and point textbee at the published URL.

1. 1

   Add the webhook route

   Ask Agent for a POST route that reads the raw body, checks X-Signature with TEXTBEE_WEBHOOK_SECRET in constant time and stores sender and message. In Express, mount express.raw({ type: "application/json" }) on that route so the body arrives as bytes.

2. 2

   Publish the app

   Open Tools, Publishing and click Publish. Autoscale, the default, scales to zero when idle and needs a few seconds to wake up; textbee retries on a timeout, so replies still arrive. A Reserved VM never sleeps if you want instant handling.

3. 3

   Add production secrets and register

   Check that both secrets are set for the published app under Publishing, Adjust settings, Production app secrets. Then add https://<name>.replit.app/<your-route> in the textbee dashboard under Webhooks with MESSAGE_RECEIVED and the same signing secret.

Paste this prompt into Replit

The prompt below carries the endpoints, the payloads, where the key may live and the Replit details from this page. Change the line that starts with What I want, and Replit builds the feature without guessing an endpoint.

Add SMS to the app I am building in Replit. Use textbee, an SMS gateway that sends and receives SMS through my own Android phone.

Facts about the textbee API. Use only these. Do not invent endpoints or fields.
- Send an SMS: POST https://api.textbee.dev/api/v1/gateway/send-sms with the header x-api-key: <TEXTBEE_API_KEY> and a JSON body like {"recipients": ["+12015550123"], "message": "Hello"}. recipients must be a JSON array of E.164 numbers, even for one number. Optional fields: deviceId, simSubscriptionId, scheduledAt (ISO 8601, in the future). The response is {"data": {"success": true, "smsBatchId": "..."}}.
- Check delivery or read replies: GET https://api.textbee.dev/api/v1/gateway/messages with the same header. Filters: direction=received, smsBatchId=<id from the send>, from and to as ISO timestamps. Each row has a status such as sent, delivered, failed or received.
- Receive an SMS: textbee posts JSON to a webhook URL I register in the dashboard. A MESSAGE_RECEIVED delivery has these top-level fields: smsId, message, deviceId, webhookSubscriptionId, webhookEvent, idempotencyKey, sender, receivedAt. The header X-Signature holds an HMAC-SHA256 hex digest of the raw body, keyed with the signing secret I set on the webhook. Retries reuse the same idempotencyKey.
- Limits: One Android phone sends roughly 10 to 15 messages a minute. Text only, no MMS. Messages over 160 characters are split into segments.

Rules:
- Store the API key as a secret named TEXTBEE_API_KEY. Call textbee only from server-side code, never from code that runs in the browser.
- Do not ask me to paste the real key into this chat. Tell me where to add the secret instead.
- For incoming texts, create a public server endpoint, check the X-Signature header against a secret named TEXTBEE_WEBHOOK_SECRET, and ignore a repeated idempotencyKey.

What I want: Text each class member a reminder two hours before class, and mark them as confirmed when they reply YES.

Replit specifics you should know:
- Secrets are added under Tools > Secrets and read with process.env (Node) or os.environ (Python). Static deployments cannot read them, so use a server.
- The dev URL is private and temporary. The webhook must use the published replit.app URL.
- For the webhook route in Express, use express.raw on that route so the signature is checked against the raw body.
- Published Autoscale apps can cold start in a few seconds. Respond to textbee with 2xx quickly and do slow work afterwards.

Build it, tell me where to add each secret in Replit, and add a way to send one test message to my own number.

Features to build

Class and session reminders

A scheduled job in the published app texts everyone booked for the next session. A YES reply marks them confirmed.

Bot that answers texts

The webhook route passes each incoming message to your logic or an LLM call and texts back the answer through the send route.

Internal alerts

A script on a schedule checks a price, a stock level or a website and texts you when it changes.

Why Replit builders text from their own phone

No connector plan needed

Replit connectors need a paid plan. A textbee key in Secrets and a short route work on Starter too, so a side project can text real users before it earns anything.

Text anyone while you build

Your class list, your beta testers and your own number all receive texts from the first run. There is no list of verified numbers to maintain.

Replies your bot can read

Every incoming text reaches your route with sender and message, which is all a reply bot or an LLM step needs.

A cloud SMS provider in Replit vs textbee in Replit

Per-message prices by provider and country, with sources and dates, are on the provider comparison pages.

What works and what does not

What Replit charges

Secrets work on every Replit plan. The free Starter plan includes one published app. Core is $20 a month, or $18 a month billed annually, with unlimited apps. replit.com, checked on October 22, 2026. textbee itself charges a flat monthly plan with messages included; see pricing.

Frequently asked questions

Sources

1. replit.com, checked on October 22, 2026
2. docs.replit.com: Secrets, checked on October 22, 2026
3. docs.replit.com: Development URLs, checked on October 22, 2026
4. docs.replit.com: Deployment types, checked on October 22, 2026
5. docs.replit.com: Connect via MCP, checked on October 22, 2026

Read next

• Appointment reminder text messages from your own Android number (SMS API)
• A two-way SMS support inbox on your own Android number
• Build with AI: one prompt for every builder
• SMS API in Python
• Add SMS to a Base44 app: backend functions that text from your own phone
• Add SMS to an app you build in Cursor: one prompt, a rule file and the MCP server
• All integrations