static username and password for private server

[AlvaroMartinezSilva]

Feature Request: Static Username & Password Authentication for Private Servers

Summary

Add support for static username and password authentication for private/self-hosted deployments of the SMS Gateway server.

Problem

Currently, authentication relies on token/session-based mechanisms.
For private deployments running inside trusted environments (LAN, VPN, home server, Docker Compose, internal company infrastructure), it would be useful to support simple static credentials configured via environment variables or configuration files.

This would simplify:

Self-hosted setups

Reverse proxy integrations

Internal/private usage

Automation scripts

Lightweight deployments without external auth providers

Proposed Solution

Allow the server to optionally authenticate requests using static credentials.

Example environment variables:

SMS_GATEWAY_AUTH_USER=admin
SMS_GATEWAY_AUTH_PASSWORD=strongpassword

Or alternatively:

BASIC_AUTH_USER=admin
BASIC_AUTH_PASSWORD=strongpassword

Expected Behavior

When enabled:

Requests to protected API endpoints require Basic Auth credentials

Credentials are validated against configured static values

Existing token/session authentication continues working normally

Feature remains optional and disabled by default

Example Request

curl -u admin:strongpassword
http://localhost:3000/api/mobile/v1/message

Suggested Use Cases

Docker Compose deployments

Home servers

Small business installations

Internal company infrastructure

Self-hosted SMS relay setups

Reverse proxy protected environments

Benefits

Easier self-hosting

Simpler configuration for non-technical users

Better compatibility with automation tools

Reduces dependency on external auth systems

Useful for trusted/private networks

Additional Notes

Feature should be optional

Credentials should never be hardcoded

Environment variable configuration is preferred

Compatible with existing authentication system

Could reuse existing middleware for Basic Auth validation

Possible Implementation

Pseudo-flow:

If BASIC_AUTH_USER and BASIC_AUTH_PASSWORD exist:
Enable Basic Auth middleware
Validate Authorization header
Else:
Continue using current auth flow

Environment

Self-hosted deployment

Docker Compose

Reverse proxy (Nginx/Traefik/Cloudflare Tunnel)

Android SMS Gateway clients

[capcom6]

Hello!

The User API does not use tokens or sessions by default. You simply get a username-password pair from the device and use it. These credentials are static and never change on their own. If you have multiple devices, you can register them under the same account as described at https://docs.sms-gate.app/features/multi-device/

In the current flow, you don't need any additional server configuration at all.

Why can't you use the credentials from the device?

[AlvaroMartinezSilva]

I mean i have development pre and pro and i wanted tu use the same user and pasw for the three envs but dw i already finished it , ty all for this project i loved it

[capcom6]

In your case, setting static credentials won't work properly anyway. These credentials are used for external integration only. There's also a mobile API, which uses a different token-based authentication system. Therefore, even if multiple servers have the same credentials for the user API, seamless device switching between them won't work because the token and device ID will be different on each server.

The only way to create multiple environments for your use case is to synchronize the database, at least for users and devices.

Best Regards,

[github-actions]

This issue is stale because it has been open for 7 days with no activity.